glupteba | 2024-05-31_04fe916f4519962d6bc9dfba1a58470b_snatch

General

Target

2024-05-31_04fe916f4519962d6bc9dfba1a58470b_snatch
Size

8.5MB
MD5

04fe916f4519962d6bc9dfba1a58470b
SHA1

1ff74a90d177a5654976cd174907541c846b815a
SHA256

9fb828f27bb0b7796d3e84c776508e8c5f93cdc6e6fdb1da9c7e3d1fe27bf2a6
SHA512

acb589ca208360b1fa6e1460e8e3ad6bbd76320ff3076de402d38d8af9f4a90bb47adbbf0eae4b74d951cb342b1375657aa9b91cba124eea5032c8a4c54b2d90
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nZ/GqhZytTD5iq:y/iNUr+v1ThwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba family
glupteba
Glupteba payload 1 IoCs

Processes:

resource yara_rule

sample family_glupteba

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-05-31_04fe916f4519962d6bc9dfba1a58470b_snatch