General
-
Target
2024-05-20_07509e7bfdeb2027d021b7f98539c040_ngrbot_snatch
-
Size
9.5MB
-
MD5
07509e7bfdeb2027d021b7f98539c040
-
SHA1
67603029c5b092bcc39fac5187d6f3cf93233cb6
-
SHA256
544e7e6b6893fa07a4fa3fa457a48723a8f51c404077a27bd25c736cf4df4fc7
-
SHA512
1081ffc6af19d6cef2f12b06b9afc73f85db620440d9ec623fcdf14bb35b5b1668e7ee59cf73081618ad9bc1be758ee673e97400b5e34961d1eeae2d76235790
-
SSDEEP
98304:t25Y4P6vABpwXgOlx8UJEZMFCEd+MFQlpM3:zW6vA8d8UJE+FPdspM3
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-20_07509e7bfdeb2027d021b7f98539c040_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections