2024-06-09_1ccbcdc5bb6dd3135907f805fc072d3f_ngrbot_snatch

Sharing

Target

2024-06-09_1ccbcdc5bb6dd3135907f805fc072d3f_ngrbot_snatch
Size

17.2MB
MD5

1ccbcdc5bb6dd3135907f805fc072d3f
SHA1

b6cacf12feacfe969c66dd8d4a287d4d2ffbe461
SHA256

91f7ba2b1432786f1e81283e7e0b96f9bc0e731fc81d9683d236efd7696689b3
SHA512

20052751eb6a1b16f9c345fcfda4f160aa65f135c32fa3b63d356447090e93c64d15da2338664b60c1a9fa2e4d4b3e3b9faa97ce680fb4bd650cb9daf56af7b5
SSDEEP

196608:JgbAcABaYqlIbMmCiitlinOQV2vKtTTPH:JgUc4axFW

Score

10^/10

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-09_1ccbcdc5bb6dd3135907f805fc072d3f_ngrbot_snatch