General
-
Target
2024-06-19_701b813d6bbe5091c6e332bbf7e008df_ngrbot_poet-rat_snatch
-
Size
14.2MB
-
MD5
701b813d6bbe5091c6e332bbf7e008df
-
SHA1
14664341174c69821154feb1cd39dd151be8adf7
-
SHA256
0d41040b5150d2d9fabe3a1d5361cf7f541a1dc6ed33f7d953ca398dabacd0cb
-
SHA512
961502098f6d5edb0c6ec6fd6ebd7669f3ff775aa75f8752ad5f09de21fac1ef3b8904c0b63ccf9a10ab6c943d16212ca62e9cb663778354f680e44e72440c29
-
SSDEEP
196608:+4uErphylkPqZ9BAy+35z32msn8iuAwVvfSw895ptvwz:+9E1MBAMxzCR2Xv
Score
10/10
Malware Config
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-06-19_701b813d6bbe5091c6e332bbf7e008df_ngrbot_poet-rat_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections