General
-
Target
2024-05-15_d3101a3ca5d8f16baece2aea8bed4363_ngrbot_snatch
-
Size
9.3MB
-
MD5
d3101a3ca5d8f16baece2aea8bed4363
-
SHA1
aff78fc74e212e9ee969515959600f06eb86b48d
-
SHA256
f49ca7c9949b0978ef7a891ca76e70cb5dc2bce0b3cae2a293343fb0a816c7e1
-
SHA512
d4d49b624914a088839e484ec49b7fc29815fd69ee2a4745edcef16e8c258c93bf48ab8236bb33be408cd919dd2a4f39625acfdb89d63d2e397bb638614350a6
-
SSDEEP
98304:7n8QQJoxrRUWk4/v8rE88ky07qUWYEN4GH/tweqG9Y9QKsI+:7QexrRUWk4Tn07qUwN4GH/ttqcKF+
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-15_d3101a3ca5d8f16baece2aea8bed4363_ngrbot_snatch
4f2f006e2ecf7172ad368f8289dc96c1
Headers
Imports
Sections