glupteba | 2024-05-31_bdb6c25f23855e6120c832f72592a8b0_snatch

Sharing

Target

2024-05-31_bdb6c25f23855e6120c832f72592a8b0_snatch
Size

8.5MB
MD5

bdb6c25f23855e6120c832f72592a8b0
SHA1

e22e0093364f8964801058b2e05117a852355308
SHA256

b3a782d10aad9a997ad23fceb996f167b68b26727a02496abb6d9e1c9572b39a
SHA512

4c8a78d782137598efbac1076d87508cdc81cde0512d8144cff7bf0a3b0b67081d72261c8d58049c33cfe69406e43cb92dcea2c98527628e6a4482d7092d8e6d
SSDEEP

98304:y/tkNUvApWlmDJY8hv9zQC1nu/GqhZytTD5iq:y/iNUr+v1MhwN

Score

10^/10

glupteba

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many varying, potentially fake Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Glupteba payload 1 IoCs

resource	yara_rule
sample	family_glupteba

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-31_bdb6c25f23855e6120c832f72592a8b0_snatch