General
-
Target
2024-06-07_67a3fb62b76c95b4292c7ea52652ffb6_ngrbot_snatch
-
Size
9.5MB
-
MD5
67a3fb62b76c95b4292c7ea52652ffb6
-
SHA1
d92c9b5e44de3d7fba91d878de38607cd8e98da0
-
SHA256
296942f67eb306fd3cfef10f83779e77cad1df4a90d6250ecf5abadc9ca8c757
-
SHA512
9fc8e1aa53510573ff8bc0650f9dc2a7148806a929057c7733db88bb06b71ddc152611f9429363de53e56486b4f3c3726d64e9e4d0aa6cd2183f1a10e7549866
-
SSDEEP
98304:H25Y4P6vABpwXgOlx8UJEZMFoEd+MFQlpM3:1W6vA8d8UJE+FBdspM3
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-06-07_67a3fb62b76c95b4292c7ea52652ffb6_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections