General
-
Target
2024-06-06_263637e20a08289046d5487d819e49d2_ngrbot_snatch
-
Size
9.5MB
-
MD5
263637e20a08289046d5487d819e49d2
-
SHA1
545482547213c7e456ce2a887efc1292646b3b09
-
SHA256
2c3436b6fe9578e2ca5b26b2d8bd29cfa57c8f78ae1f0e7ee118726e7ae463c7
-
SHA512
d6b45e6dddbb0a60eaf6bc6e38e51ee10608921622d345a14c588c28192665c0384229afdae1e06e3e92b79b60365fa240087d8e2cc9d78c268135d3d6b1759a
-
SSDEEP
98304:HNUTGz+4vDlr6i9Mkv/zOS1tyMEzQkSF8Yf3c:2A+4vRx9j/zOSLylzQhf3c
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-06-06_263637e20a08289046d5487d819e49d2_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections