General
-
Target
2024-05-04_a43fd9f01a70459db18fe0a231739fea_ngrbot_snatch
-
Size
9.6MB
-
MD5
a43fd9f01a70459db18fe0a231739fea
-
SHA1
d66da6c51247b8a494497c176d8f3446dd45aca2
-
SHA256
5b1a152592d4c6e766b17d0b34d8b28ef6f54c334aed83698b2f5b0b1fd19a23
-
SHA512
ddaf4f478211c9db0eaac697e3124a2f09c6274ef7f2d0a4357b624a78e61618f38862826966813d3f575d58e60798dd4ab86e570ed6d2ebc2c7ca2760a9b179
-
SSDEEP
98304:3Q6BkVGFrlztuvCpVCLtPwcB+bnA23BYE7yEAhEtKbiG/:g6FrlzxVvw8R7kcw/
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-04_a43fd9f01a70459db18fe0a231739fea_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections