General
-
Target
2024-05-12_13b02df17c32e47f22a463e81dec91f9_ngrbot_snatch
-
Size
9.5MB
-
MD5
13b02df17c32e47f22a463e81dec91f9
-
SHA1
5e63279fac8374e347c9d987fe3530828b884e99
-
SHA256
ad911d82d391e4aa11f33d79b63b45e88a982e736790563a44c20e50c22c012c
-
SHA512
ff9cf78e94b8bc2d07e677d99e22d35b5997d8560df7eabad1e3e8b9d9eefb18337adc6b52bfb809b4a1dfbf60c4dad05d9ab0f742da86414a147228ea1138a7
-
SSDEEP
98304:ECHIJSvtVLD1XIiWkZ1GRDk/EJ/WJgv2GKD:XIovtVh8kZ1GtkcJ/9KD
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_13b02df17c32e47f22a463e81dec91f9_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections