Overview

overview

10

Static

static

10

2024-06-11...ch.exe

windows7-x64

1

2024-06-11...ch.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-06-11_9e0f9c9682693e3a6ea34c01aae9a5a0_ngrbot_snatch

  • Size

    9.5MB

  • Sample

    240611-rc1npazdrn

  • MD5

    9e0f9c9682693e3a6ea34c01aae9a5a0

  • SHA1

    5671eb33a457dfad7d9062e0af7b54af6788b23c

  • SHA256

    aa3adfba9a1ceab5ebf0e6acd21db1438215b4a1829faed2dc54a8d85f178aa0

  • SHA512

    a47bcec95bf55ff911220879685f3b0a4dd2619e60df20a9739174cb627dc53a419bcc99fd967ca6bed2efa31f6f941c3203ebd810969ba4390d28709595eb09

  • SSDEEP

    98304:XlFawepI0uNJ8r54t9wTgqU6EgG8OSF8h2n83:jvepI0l4t9w8qMv84u83

Score
10/10
persistence

Malware Config

Targets

    • Target

      2024-06-11_9e0f9c9682693e3a6ea34c01aae9a5a0_ngrbot_snatch

    • Size

      9.5MB

    • MD5

      9e0f9c9682693e3a6ea34c01aae9a5a0

    • SHA1

      5671eb33a457dfad7d9062e0af7b54af6788b23c

    • SHA256

      aa3adfba9a1ceab5ebf0e6acd21db1438215b4a1829faed2dc54a8d85f178aa0

    • SHA512

      a47bcec95bf55ff911220879685f3b0a4dd2619e60df20a9739174cb627dc53a419bcc99fd967ca6bed2efa31f6f941c3203ebd810969ba4390d28709595eb09

    • SSDEEP

      98304:XlFawepI0uNJ8r54t9wTgqU6EgG8OSF8h2n83:jvepI0l4t9w8qMv84u83

    Score
    9/10
    persistence

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables Discord URL observed in first stage droppers

    • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

    • Detects executables containing URLs to raw contents of a Github gist

    • Detects executables containing possible sandbox system UUIDs

    • Detects executables referencing virtualization MAC addresses

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks