General
-
Target
2024-05-12_eda6f1fa47e554803a3d52ee8e77f20f_ngrbot_snatch
-
Size
9.5MB
-
MD5
eda6f1fa47e554803a3d52ee8e77f20f
-
SHA1
6014b3f2c5a6ad2913aed783b871f1645b87650a
-
SHA256
ed7ef2a2bc107fefeabab0dd197af71eda689f88892dc5df027a04ab96560565
-
SHA512
e5a6486416c101bd65e77ad51f0ac5039ccde1b7443a9f39e1bef182fb80eef0de2b7f299f9e570d6a5244a55f54a3fd8c12e84f65565fe1284f09fdbb86c4c8
-
SSDEEP
98304:Fc9x3y76b8NN6pQ7LF0xS5kLEEPgqFg2C030:0Zg6biy+F0xSyL9P3C030
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-12_eda6f1fa47e554803a3d52ee8e77f20f_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections