General
-
Target
2024-06-11_9e0f9c9682693e3a6ea34c01aae9a5a0_ngrbot_snatch
-
Size
9.5MB
-
MD5
9e0f9c9682693e3a6ea34c01aae9a5a0
-
SHA1
5671eb33a457dfad7d9062e0af7b54af6788b23c
-
SHA256
aa3adfba9a1ceab5ebf0e6acd21db1438215b4a1829faed2dc54a8d85f178aa0
-
SHA512
a47bcec95bf55ff911220879685f3b0a4dd2619e60df20a9739174cb627dc53a419bcc99fd967ca6bed2efa31f6f941c3203ebd810969ba4390d28709595eb09
-
SSDEEP
98304:XlFawepI0uNJ8r54t9wTgqU6EgG8OSF8h2n83:jvepI0l4t9w8qMv84u83
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-06-11_9e0f9c9682693e3a6ea34c01aae9a5a0_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections