General
-
Target
2024-06-27_d32b6497f96085710fd6a1ad10e82330_ngrbot_poet-rat_snatch
-
Size
9.3MB
-
MD5
d32b6497f96085710fd6a1ad10e82330
-
SHA1
11af8afa2f63fd797e6dbe306ea8181c3480119a
-
SHA256
429c2396e234402ecf200be749e737dd4f969c8457e50eec8cde4fe4b486d712
-
SHA512
e6eb4ec19ad1d3f813028428b81fc931bd6739845958b541c2b70425bed553910467c29df6ccdc0d6fb9cc30cca91491e632bb30e5cf38a2109b30dc9e014b2f
-
SSDEEP
98304:wsGLMqMUzFeUoGgcmmPsWvpIqGEV6wKIii8HlD+:EBMUzQyPsWvCqjsfD
Score
10/10
Malware Config
Signatures
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Detects executables containing possible sandbox system UUIDs 1 IoCs
-
Detects executables referencing virtualization MAC addresses 1 IoCs
-
Skuld family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2024-06-27_d32b6497f96085710fd6a1ad10e82330_ngrbot_poet-rat_snatch
c2d457ad8ac36fc9f18d45bffcd450c2
Headers
Imports
Sections