General
-
Target
2024-05-11_46823d56e681877755a5fcc5ef719f4d_ngrbot_snatch
-
Size
9.5MB
-
MD5
46823d56e681877755a5fcc5ef719f4d
-
SHA1
47e7024b2b23b16bea0521cc72443f9e0913db21
-
SHA256
487b6f54ae00a81afd2b595ab204df25003001574567715346e8b134c4c0dc28
-
SHA512
c95aca7295755858b9ceba63ffc97acad964c0edf00d0b0eb4de184dbe75e236aa0a64d36f48833311a14ccd106ec73185d5ca7124e9bde315c9e2770b98f807
-
SSDEEP
98304:uPlSsz0vq91ncrORvs0SSK2g8Rw2EplESF8S2jC:1e0vqvKes0SSvgpplv2jC
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-11_46823d56e681877755a5fcc5ef719f4d_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections