General
-
Target
2024-05-25_6a7d0d19b42cc78173f4fee0c01d8ca7_snatch
-
Size
8.9MB
-
MD5
6a7d0d19b42cc78173f4fee0c01d8ca7
-
SHA1
72cc46910fd0eebbdfb659651db2d167f1839b05
-
SHA256
b9e94fccd5b1a3990a817cd808c14ba33da8e3b541608f0e5e10e1634d8fb9d2
-
SHA512
17fa9eb46edea6985345969c59e2f3417ee1230039cf6548cad19ed31a583a5a2b86d366ab4a6ea901727418969d22ff9af62d8b3846cbf17dd4454e555e6283
-
SSDEEP
98304:uHxMZDJ1TRpxYVX9u2IazANfvhZytTD5iq+:0xEvYjVzAN3hwN
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
-
Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs
-
Glupteba family
-
Glupteba payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-25_6a7d0d19b42cc78173f4fee0c01d8ca7_snatch
9cbefe68f395e67356e2a5d8d1b285c0
Headers
Imports
Sections