glupteba | 2024-05-29_4388c459b182def2a6621488b8efa587_snatch

Sharing

Target

2024-05-29_4388c459b182def2a6621488b8efa587_snatch
Size

8.5MB
MD5

4388c459b182def2a6621488b8efa587
SHA1

c3648e77f3a2587a3ebeeeffb710fd35ae4d9b5c
SHA256

c9ed2868aad5f5585856301c94acaa0e666c1b7b62420c549db0e609108475e5
SHA512

c323d50d6aa499dbfd06734047dea5f7beda6aae4085634bfc0206f66b63b7f68349125c8b82b6b514e5021abf7d7f0ba87e3555572aca9fde73da7c30519fb9
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nR/GqhZytTD5iq:y/iNUr+v1bhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-29_4388c459b182def2a6621488b8efa587_snatch