General
-
Target
2024-05-13_858aaffff4a0935c91e30e252a0110e7_ngrbot_snatch
-
Size
14.2MB
-
MD5
858aaffff4a0935c91e30e252a0110e7
-
SHA1
373cb1f3634b50eac10899b487c24f61d5dca273
-
SHA256
4d0c5a7a9bbbb91e1de2dc4a6ebede537da53798c3c5315768858ea241ff6c60
-
SHA512
af4e8c03c563d24012945ed6d19b91cd5c742b69b0e28dcabde24108f8445cfd481ce5efedffe9dcc7bc52c3add3be3655dfad611eef4dcf84d4c24cfab86aac
-
SSDEEP
196608:5KLOhO94DSBkS62KtoQqn3rpxqqYGZiCV42T3Cv37ktdJm:5KQOy1toQ6HYG0/xQDw
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-13_858aaffff4a0935c91e30e252a0110e7_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections