General
-
Target
2024-05-12_5f8036ace57ad49b8f3f9341eaaf8c2d_ngrbot_snatch
-
Size
14.2MB
-
MD5
5f8036ace57ad49b8f3f9341eaaf8c2d
-
SHA1
64eda78411d6fe303c02b6426865a8fdf6399c6e
-
SHA256
864e0934f45eeac3f6d41b74a5147aa6657025e1d1dc2fb60b16f33ede053aeb
-
SHA512
a14375eed349d52d1535898f8d06c867b9b45410dc62f6578638896506acbf08b6cd650b124fbfcb4931e9e4db8698662628fdd69aee2dc48a8ad14345e47f86
-
SSDEEP
196608:gozg3w90nrbYmdmvPsZ7RpP8n30uClJtxayT8:gsgAgdWsfpjuClJtxam
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_5f8036ace57ad49b8f3f9341eaaf8c2d_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections