General
-
Target
2024-05-14_f9298b7b62ecf17757058d0d13eaad0a_ngrbot_snatch
-
Size
9.5MB
-
MD5
f9298b7b62ecf17757058d0d13eaad0a
-
SHA1
009fb4039a0ef403942d7579cf82311f5f3b4fcd
-
SHA256
e73bfd7065e053571e1b91ae0236f699e3325dea1a9a11440eebf2a2e7bb8170
-
SHA512
683547ee99a15c1c37f42b6a9841ad67ec6e3239bed078b6ed8666257016a369abff957bdabcd09f590e12c7314dbae2fd5e6289280afd933844659b3a496cf5
-
SSDEEP
98304:gYKw+W6kPBiJOmzPx0NEzB5rEVZqFgwC735:gbW6kYgUx0NEV54VMC735
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-14_f9298b7b62ecf17757058d0d13eaad0a_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections