General
-
Target
2024-05-12_81dcd58f71d429d47f3b01c12fb4f775_ngrbot_snatch
-
Size
14.2MB
-
MD5
81dcd58f71d429d47f3b01c12fb4f775
-
SHA1
e4010340e18aee24db6ed9244f69269562c86c87
-
SHA256
4272a321c7ab3954c1e71340516bfde2eb6af4b1b205242dbbd8cefb2cf09d6e
-
SHA512
a8661f4f601deee96a740b6ebdfacde2f9791be326dccace98e4c4020e318961ad3f85ebd434d90cd7014180a2ba34c0f9427f8e21882516c7de80e3c6c75023
-
SSDEEP
196608:Q66gcO90fr7YWd2jIsZ7RpP8n30uClJtxayT8:Q7gPgdZsfpjuClJtxam
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_81dcd58f71d429d47f3b01c12fb4f775_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections