General
-
Target
2024-05-04_e42a9c55aafd6b56913fa605da154f89_ngrbot_snatch
-
Size
14.4MB
-
MD5
e42a9c55aafd6b56913fa605da154f89
-
SHA1
f8b9ffc165d4d0fc45cd354aac146fb19a655747
-
SHA256
f7090dde51acd19f0eca8cffbd45ca3fd1c3492a608b409bfeb197f02517a05a
-
SHA512
6a63236718cdbc4c50b77e0463f1bcc655a3a18a360c0f73babbd6659504c7dbe6daea27e27c43577cd6a86dae093af3546141dc12c7ce4548170175f05f91c9
-
SSDEEP
196608:Bl1lEcjicfPxuc0wwFMeDZRRNzmgNpeetc2:r1lT+AxucgMeXTmKpeeO
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-04_e42a9c55aafd6b56913fa605da154f89_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections