General
-
Target
2024-05-15_04d79f61648498cb9738cc7ef907f640_ngrbot_snatch
-
Size
11.8MB
-
MD5
04d79f61648498cb9738cc7ef907f640
-
SHA1
2e2523bb6adb6b3134278969de9cee511c512ade
-
SHA256
135211ce32a3f602fac3f965ee195cc679d413bb3cb1d7ebf3a43f41e6f6104d
-
SHA512
78f7e6b70836ec0cd91c31afd4cf28a0abfc07624da62ab243dc379d9c2e757017172982159e87e518bf31ddd5cb06a673742ac0affd65fb283326ecb337cde1
-
SSDEEP
98304:ce/Ug30aM7wKnCZ714shyP4AduL3EFDY1pqxu/CRjZNlZbp4vHzz:cTy0aM4qshWdU0FD2pqfZxKzz
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-15_04d79f61648498cb9738cc7ef907f640_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections