General
-
Target
2024-04-27_78d8a36f29d4aea8337e05531c58a4a8_ngrbot_snatch
-
Size
9.5MB
-
MD5
78d8a36f29d4aea8337e05531c58a4a8
-
SHA1
3582382a7f2e27b2ad15d2f1e8415241b8cd1d54
-
SHA256
a4321ced692a593a7a6eafb941b642228f1f4032794d43a935cc972454d56999
-
SHA512
69b39d2c6c3a7f86f1680a862cc27e047e59b07ffe65a10118c20ea4f3bf29cee2c38063a5c9d6644a48e9dbef1627c35f8e53af27e5837086b489d261f7f303
-
SSDEEP
98304:yb5Ga24vuO+w8IEVuUYEyCJvEmUMFQMpPj:ZN4vu5uUYEDJsmDpPj
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-04-27_78d8a36f29d4aea8337e05531c58a4a8_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections