General
-
Target
2024-05-21_fac612e367bf44f714ce5c0c3f6350ef_ngrbot_snatch
-
Size
9.5MB
-
MD5
fac612e367bf44f714ce5c0c3f6350ef
-
SHA1
38757a7e8f56939daa6f5f82e819e7096af58e56
-
SHA256
3d3947551817b2e8df2caae44ce780000497c1a83f85d59af2e2edcf4f4c8bf7
-
SHA512
45dc2b59d5d073a1b63b7e351f0e0d3a4981c3cf0799ab56a45b62436e0e999d1639a66018f4c2ef3dedbc0ccbddef03ea0d5f95bf2456af06e21c361eec4e66
-
SSDEEP
98304:pcrBJkYyZZFZ9IDkN0RSs3muEJ8qSF8Id3X:qfkYyxLVN0RSQmLJ8fd3X
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-21_fac612e367bf44f714ce5c0c3f6350ef_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections