General
-
Target
2024-05-05_387a98fcef6d606288616f0e8187e6f3_ngrbot_snatch
-
Size
9.6MB
-
MD5
387a98fcef6d606288616f0e8187e6f3
-
SHA1
101ea00908ecc633a55cea881becb19376b8b12c
-
SHA256
fea009a48b5c93326ed9343cf8b1fc47e659ae08a3a1dac2dafde2a7c93f38bf
-
SHA512
eb0047a088233ee2e3df6a0f98252919575b1fc3667a351126a8e6970ef08dfe3d49aa6df685ba19a9156e42d2904143398bb840a26ae9355975fcb8d78e513f
-
SSDEEP
98304:DLIyO/4GOV1yHTGQasSIpQyLHJNl4eElDEAEEt3bAE/u:UPOV1bQNJ8blWcH/u
Score
10/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-05_387a98fcef6d606288616f0e8187e6f3_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections