General
-
Target
2024-05-12_a3f779e15e40e6ceafb62093600431da_ngrbot_snatch
-
Size
9.5MB
-
MD5
a3f779e15e40e6ceafb62093600431da
-
SHA1
b6e8a2114ae00e16f976859679a67c576beeaad1
-
SHA256
2e24c77c1e27a77e8312a9961b0dffb937decf175cf71e077fc2f4b31cec7e7f
-
SHA512
60463509850ecffdd941b24f98d19b74db976632bbf9ff07dbe0e00d528a10589ee978ad3cf395edeaf7efcd834568cfeff1dfc42d32c29b4871d7c1e84243fc
-
SSDEEP
98304:xE5p/yYPMhNSn53O50TL523tEEGSF8poju:wlyYPi8M50TLQ3+Eioju
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_a3f779e15e40e6ceafb62093600431da_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections