General
-
Target
2024-05-12_193f82f3bc5690cdad8663201f02a8f2_ngrbot_snatch
-
Size
9.5MB
-
MD5
193f82f3bc5690cdad8663201f02a8f2
-
SHA1
27d63f51d3c1a1cccaac536cccabba31372f6c37
-
SHA256
338d143d67eb6e7364c778e798c340bbc804f8f9688b45229304446decf1a135
-
SHA512
eb9271d8391c60e7d0df82ad8e125f43483356de4f118e75f408aadc1b2de221e1bc8a5b5bb17c0286c303ec414fdcbff39edd68ede0b5a2ba308768b7af1469
-
SSDEEP
98304:EPlSsz0vq91ncrORvs0SSK2g8RwqEploSF8SZjC:ve0vqvKes0SSvgBplrZjC
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_193f82f3bc5690cdad8663201f02a8f2_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections