glupteba | 2024-05-31_b204ac722683f74a0e7e83f68d31a635_snatch

Sharing

Target

2024-05-31_b204ac722683f74a0e7e83f68d31a635_snatch
Size

8.5MB
MD5

b204ac722683f74a0e7e83f68d31a635
SHA1

224adf5e129df1c9bf055b458f2a2daa4e00cd6f
SHA256

1e7ce4663540dd20c87a83eea1ed598c04a734b047be1322045a46233870b485
SHA512

fd10311a5c2e3bef81cc932b2e7e6c2674ba025e13677fd1afe7af011da151800755e0bf087876d254de9d76d1ba0532b906bfc9b8d3b0f9ac6b6149bb87b19d
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nu/GqhZytTD5iq:y/iNUr+v1MhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-31_b204ac722683f74a0e7e83f68d31a635_snatch