General
-
Target
2024-05-05_ec24b59c559b79333659d3fdb975db73_ngrbot_snatch
-
Size
9.6MB
-
MD5
ec24b59c559b79333659d3fdb975db73
-
SHA1
67a1de20c09d7adfc05376ae5f09dbf8530361a1
-
SHA256
f977b95107a1ab9a21a00c5a7f72f9663683a42607989fd8f9342cebc721d4f1
-
SHA512
9279f64b3a9e210d8591226562d88845c27f41668e611416c3f63704daecf72828c62aca598084fe48f8e9413580c4e73008e63adb3091ebbd1b35847e89e314
-
SSDEEP
98304:zDSmsBd1Bh3j0NdGKYfFUr6xlAeREl0EAEEt3bAE/G:WBd1ByN8hvyl7cH/G
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-05_ec24b59c559b79333659d3fdb975db73_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections