General
-
Target
2024-05-12_da6c0a2c16e355a32272bbd1cd0b358d_ngrbot_snatch
-
Size
9.5MB
-
MD5
da6c0a2c16e355a32272bbd1cd0b358d
-
SHA1
a4e34aa72e73bbe4f6eaf95585d169a61e10ad21
-
SHA256
773d7e6f33c573252a6e478116996364e7af8a247699dd774b9a9767f6faaf84
-
SHA512
1cb4afaab5860f68430f38c7e9c9c5d4c178573549338b476517537705789c41675f4e316eab3c9a22a83caaa3a4d73c5aa3737c2fc73dd4740f42af8d8f6408
-
SSDEEP
98304:zPlSsz0vq91ncrORvs0SSK2g8RwuEplgSF8SZjC:0e0vqvKes0SSvg9plDZjC
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_da6c0a2c16e355a32272bbd1cd0b358d_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections