General
-
Target
2024-05-31_5fc67b399222bc097a58ffe80ffda625_ngrbot_snatch
-
Size
11.9MB
-
MD5
5fc67b399222bc097a58ffe80ffda625
-
SHA1
e98cdf2238723df3ae10f5ee14311dea4694678b
-
SHA256
2159268699e59f18097d3ca8ce033539a0e926e852c339e5752d8ddc9e5cf414
-
SHA512
0db192ea82a7c312b7522103f8f477105471fce21b7ed6c0d81ceb10447f52e06ecb84cf7b230e91f8ea9836972033f0204587475508888a340f0cf5822ae0da
-
SSDEEP
98304:H1BQ9pJKU4OtsdeEcqDFJ+bMKaeyng0EEVAApEL4Vsq5TymN7JIFbDp+SgjHQ9JU:+JKUftseugNEi5DwHKBe
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-05-31_5fc67b399222bc097a58ffe80ffda625_ngrbot_snatch
4f2f006e2ecf7172ad368f8289dc96c1
Headers
Imports
Sections