General
-
Target
2024-05-12_f3f290dbf984d18874ee7cd773129263_ngrbot_snatch
-
Size
9.5MB
-
MD5
f3f290dbf984d18874ee7cd773129263
-
SHA1
fdedbfd8422db841234ffad629ac75aa02662d72
-
SHA256
8dc4ae49aca9ea82863c4eb11f2bc616744c8ccef838590ac1fd4eef091cb968
-
SHA512
c5fee069db24e873903927f06ee964eece3195b5ab6d10dd4b114525b88b44c505bd0ff5382e586e6f27f8263eccf05984629e83b45780aad8d573d12d7bd299
-
SSDEEP
98304:EELyY2Y2QCV6aDb3M0jSuxZrEplHSF8S0jC:132Y2fd/M0jSMZ4plc0jC
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_f3f290dbf984d18874ee7cd773129263_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections