General
-
Target
2024-05-11_5850a27f12688a08d9e62875dcb13f8e_ngrbot_snatch
-
Size
9.5MB
-
MD5
5850a27f12688a08d9e62875dcb13f8e
-
SHA1
7937057482d3213775472584c2984593fe4bd5f6
-
SHA256
2786d3a137e927931b0f6268f5ab99c4e04a687dcb7b3d311168a00424ee4872
-
SHA512
d12282a4967b4f4fad563be61aea9f2d8f5528b23443ab2552fb9e4efe6526650ac046604efdda07157ab44a5d1db0d4e54e91b93c27f811f0f19a8594090b79
-
SSDEEP
98304:fjpo3kav70I0bHv27W0drBRVAQklEq2MSF8aejw:K0av7ILgW0dr/Vxq2Tejw
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-11_5850a27f12688a08d9e62875dcb13f8e_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections