General
-
Target
2024-05-23_898d502ac5fc9d0e48e47aadbbd3cb73_ngrbot_snatch
-
Size
9.5MB
-
MD5
898d502ac5fc9d0e48e47aadbbd3cb73
-
SHA1
ecbb4683dcff42c17a3bc7c48df85ce39c5938de
-
SHA256
d3cb3823d0d06f044dd92340d6c4b96fb7cf399fbd2933ce4d912f5f17e07e06
-
SHA512
c1f18859c97452aea92c018bca6d953742594e132e49587f436364c438594180c9a0aa767e809edf3930d7346cf7153f766be0fd27db231338e2d2cbf95522b0
-
SSDEEP
98304:tTpJGtW3dCYeTSalXtazFwFEKsFSFUE4vuT:TctW3AlXtapw2Ks84vuT
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-23_898d502ac5fc9d0e48e47aadbbd3cb73_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections