General
-
Target
2024-05-04_8758db78cd59a50f3fc67700b12dedc8_ngrbot_snatch
-
Size
9.6MB
-
MD5
8758db78cd59a50f3fc67700b12dedc8
-
SHA1
ab3fc2a7ce29db9ba1ccf81f816c64e696f47639
-
SHA256
177e4d4e789d35b6c8f376a3aba931b6cfbea3ca627ab78161a260022ef997e3
-
SHA512
83d3ffcd475569310ce3403e815483aa67e68f0f19c476b70d56c390d184bfbc35ada275128e2944696e8e5ac42b9a519d6d336eeffd381f7ef26446df6c6e95
-
SSDEEP
98304:NwBikSXe7lSS8+3qbdLePw8h+bnA23B2ExcEA7EtbbVG/:Cue7lSJbJw8zxcc0/
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-04_8758db78cd59a50f3fc67700b12dedc8_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections