General
-
Target
2024-06-14_8d90087962be2025b29f926c7d260c85_ngrbot_snatch
-
Size
11.8MB
-
MD5
8d90087962be2025b29f926c7d260c85
-
SHA1
10c0684912d50a3f88d5c512e0efb8cc847b5e05
-
SHA256
c64df35934b266999be64cf5ed4f98419e858b4e4b9a93319045b532a312fd6f
-
SHA512
c391e6eef6b2a15f7bbf4f36eab6c7c6b7644ff593fb7361a34ebf1ae2aa313afd1ed8ca9758a0db0ed5b25fb9797cb328f4c7451ddd1a4791d44e6dcaeb5728
-
SSDEEP
98304:xLM7FB7hRsEcI/73YsFa0L7DfyQX9EE0T5otbZDI63dm9ar5WSGnmxjM:xLcB7/sEc8+0L7jxXj04D53/sn0jM
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-06-14_8d90087962be2025b29f926c7d260c85_ngrbot_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections