General
-
Target
2024-05-12_b649b3ccb62a9d794d05dbe6edfad4dd_ngrbot_snatch
-
Size
14.2MB
-
MD5
b649b3ccb62a9d794d05dbe6edfad4dd
-
SHA1
c83aa54199939356acd058b9e9af19f6a30f85f8
-
SHA256
03358dca8d3017c681c11b60269d64ad9440ca6cc47fa2342d08c1c94b5425a3
-
SHA512
0fb710f013a50f28271cb11595fc57a257b9e5acc892b7970986f6f79cdd830c70c4e8e26ec0ee1e543a36ec11e899de5de259c6a6cee4fb1989ee6bfc63a9a3
-
SSDEEP
196608:6u3PKeS/BUDrReUqavjwQCHSIFzl83N/wrUN2Pub6PpqPJT:6+PaOqaEQCHlFzPSt
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_b649b3ccb62a9d794d05dbe6edfad4dd_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections