General
-
Target
2024-05-03_c4f47bd26e74cee55af2dc4f49e87f0e_ngrbot_snatch
-
Size
9.3MB
-
MD5
c4f47bd26e74cee55af2dc4f49e87f0e
-
SHA1
a03287de6d4b935cb19f78d4c820d3b3e0680114
-
SHA256
bf8a99c54e00ff38f115df8a3f0afa2e5080e67914966fb128bb6c5563c3284a
-
SHA512
e38ac9ae1bc8984469c82e0dc559951067559909e76f344ddb55b9394f4c62e4f5148104d2af4232346a3385811221c3be61ddf5f81179776b5dd67b0f7b8fde
-
SSDEEP
98304:I2WFke58etbgH67479hFti3Xo3JEdfkF4Chy8bX1nA1z:Uke58etbEZfti3XRdfkF4ChToz
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-03_c4f47bd26e74cee55af2dc4f49e87f0e_ngrbot_snatch
4f2f006e2ecf7172ad368f8289dc96c1
Headers
Imports
Sections