General
-
Target
2024-05-12_baf4829f72ece4bd1549b1379d870293_ngrbot_snatch
-
Size
9.5MB
-
MD5
baf4829f72ece4bd1549b1379d870293
-
SHA1
c9cec001cd29fe90b20ebebe15544a1d0729c9cb
-
SHA256
545829597246e778cd88d16a30af041b489536643c5c2c032e534e4a2096dda2
-
SHA512
a9a5a09a0ad734a0ede4d6ae51c02643e72f055ebf143ab5ff1559ad1ff038f8bb9ea9c0e30cb1ba24f1a05a3e264bc72935b999555e80815f54c9851c34b55e
-
SSDEEP
98304:RzYNgiYvnZhtsVTr7j0KLr/tYwkwEHLSF8Zdju:U3Yvn5s7j0KLLtCHbdju
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_baf4829f72ece4bd1549b1379d870293_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections