General
-
Target
2024-06-06_0db176383803faf605ead3961c4e845a_ngrbot_snatch
-
Size
11.8MB
-
MD5
0db176383803faf605ead3961c4e845a
-
SHA1
c34f0f259f1c25852a02f560e48795ba54cb7c9f
-
SHA256
814517fad515444a041f5d82c911b1d9929431da1023460bbcd5d8fd96d56075
-
SHA512
cb983ef0fafc8574b5cfa95a0dea7a89697bda2151448f09965793f27812825f9efb65c66dca7457dcbdce7dc47f56f5fa233a39facf06964754294724de9add
-
SSDEEP
98304:fKrc/JIEj2H0A+jJ+eSc58YS+QpTEtp8AZGVIQt8zaTz7f:fbWEj2s/Sc5M+Q2bZ8Xf
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-06-06_0db176383803faf605ead3961c4e845a_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections