General
-
Target
2024-05-14_de835c5e977c63ad052bfac57a6511c8_ngrbot_snatch
-
Size
9.5MB
-
MD5
de835c5e977c63ad052bfac57a6511c8
-
SHA1
57197fb2131ae5174a163cdc0301c802b56cb02e
-
SHA256
c9b0218b6aee171b0779953a559ffe1177d610bf6dfeb63a7931973eb989fe86
-
SHA512
c6c3e356bb61a657b1923e0e08858b53c6fedcfc5f83873938fbd6cc0c870d985ad44685584b9ffc128ca9dd70e90c9d284f0c55fa21bd37e5e5d9f57d319d45
-
SSDEEP
98304:gOtqibwOi+sMIyD+Rk7Jok5lE9fqFgqaqDjFy:h5bwOYRFRk7JT5W9Q5DjF
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-14_de835c5e977c63ad052bfac57a6511c8_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections