General
-
Target
2024-05-12_ba5c34fd3886eeda11cb428ca11adcf8_ngrbot_snatch
-
Size
14.2MB
-
MD5
ba5c34fd3886eeda11cb428ca11adcf8
-
SHA1
21f59987658cefdb596f40147e58705a2a4c3608
-
SHA256
316b745912fbe1327bcee57300c5b291f2440b37a24ea86fbe703d0aa8e8a679
-
SHA512
4c4ca78b8471f74e718d3539d0e47d065a66a0d4ea5c40ad5e389a6d67fdc2ae656e26eed96b2d38a24ee427945118a0848619d26056bc97d5226f4fce61a742
-
SSDEEP
196608:WuqgXs90fr7YWdovPsZ7RpP8n30uClJtxayT8:WTg8EdIsfpjuClJtxam
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_ba5c34fd3886eeda11cb428ca11adcf8_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections