glupteba | 2024-05-31_f7c0bbbcd7e382f12a7ffbbd708d840b_snatch

General

Target

2024-05-31_f7c0bbbcd7e382f12a7ffbbd708d840b_snatch
Size

8.5MB
MD5

f7c0bbbcd7e382f12a7ffbbd708d840b
SHA1

4010b7e49398e16aaf4ab4804d7c8141b26b3f67
SHA256

d1e197938cd656d85f58a0bd39f5ebe2d1e175053c4a6aff3388e93df04417b4
SHA512

b0453c79b625369aa7f01153f62334930edcbea029197768ccd254a7d76d438c484ef340a45cfd0f7320963a3a590b4cd898bb234c939795ebc395a92cbf1a75
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1n8/GqhZytTD5iq:y/iNUr+v1GhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba family
glupteba
Glupteba payload 1 IoCs

Processes:

resource yara_rule

sample family_glupteba

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-05-31_f7c0bbbcd7e382f12a7ffbbd708d840b_snatch