General
-
Target
2024-05-28_43028d1d5d5f103245b2940c2eb4a42d_ngrbot_snatch
-
Size
9.5MB
-
MD5
43028d1d5d5f103245b2940c2eb4a42d
-
SHA1
861c2a0c5b3af44209f75d85111d35c5b79bf91f
-
SHA256
dd46268434e34e67998d7c3005092ef5c9b97083ae22c46496def4eb6b0d08de
-
SHA512
f55cebf826ea5143bfcfafb548aa9d58c360614107d3a8856a96e27793d9f77771349b7a76638f5adf879e5fb4fcf60f84094be155654b0fdab17b0fd7354a59
-
SSDEEP
98304:gcjFO4pnmuXvMwRUrhzBS/G4LaEpLSF84O3X:Z84pn3vZQhzBSO4rpyO3X
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-28_43028d1d5d5f103245b2940c2eb4a42d_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections