General
-
Target
2024-05-12_775aa5127824f73d1f5f8f49885ea259_ngrbot_snatch
-
Size
9.5MB
-
MD5
775aa5127824f73d1f5f8f49885ea259
-
SHA1
219fb2b72879e75b3393a07b70a66a28f4412f67
-
SHA256
a479e5940d3e99df14b2c360c0ea505f50fe52dbf59d6f1df574b65ca8613bc5
-
SHA512
eb557c33edd377a37bb6070cd9c0cb93b3c8d210493442b384c04e1581f740d7345eb986164742323c6467f7b7dbf4c0b9d2f41eff1dd45f90ff0d02647e2a3e
-
SSDEEP
98304:vcybPJ6Cwr+Z9IDkN0RSM3m0EC3pqFg2Cy30:FbJ6CTLVN0RSwmNC3KCy30
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_775aa5127824f73d1f5f8f49885ea259_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections