General
-
Target
2024-05-29_9fb026064ec2c15104e42dcf7cbaf8b2_ngrbot_snatch
-
Size
9.5MB
-
MD5
9fb026064ec2c15104e42dcf7cbaf8b2
-
SHA1
48e5d2124260347daf308a380ac8860f29fab7f0
-
SHA256
b0e3111bd96d3f5959261b796f0a694a047241517058c0a2bce326a9d54881ba
-
SHA512
b440c20af018de198924825dbd9d341f0e19b3528b6f0bc3673eb76a13f756a0560b900c7519f0767279b4e2ffc0cb21911f6747eca93b70d3f2b98181cf111e
-
SSDEEP
98304:425Y4P6vABpwXgOlx8UJEZMFqEd+MFQlpM3:+W6vA8d8UJE+F3dspM3
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-29_9fb026064ec2c15104e42dcf7cbaf8b2_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections