General
-
Target
2024-06-01_367043efec4418f765ab8cf9446e53f8_ngrbot_snatch
-
Size
9.5MB
-
MD5
367043efec4418f765ab8cf9446e53f8
-
SHA1
cdb54eb3dd5adbffb99393387a6358f317efe430
-
SHA256
fe74586fe43f92eceff006301acd1d792c31c3378d92a62cb4de62e8ae4fdfae
-
SHA512
49d05a178377c71e6d533ab74aef4bd9a8b2af2223b33391aaee5d23687cd8a524000d6df02f92b93b1c5c3a3d2699ce45d4be048fabaad121bde7a0fbcc91c1
-
SSDEEP
98304:725Y4P6vABpwXgOlx8UJEZMFrEd+MFQlpM3:BW6vA8d8UJE+F4dspM3
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-06-01_367043efec4418f765ab8cf9446e53f8_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections