Overview

overview

10

Static

static

10

2024-07-01...ch.exe

windows7-x64

1

2024-07-01...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-07-01_bb5921e2714c9a4afd6c0aff97232bbf_ngrbot_poet-rat_snatch

  • Size

    14.2MB

  • MD5

    bb5921e2714c9a4afd6c0aff97232bbf

  • SHA1

    2bd83915a20790ccd72d478941d10deb6c5bb0dd

  • SHA256

    c8b75435bb5a12a9394b187e861900f0898682ed1ad9bfcae19d43fd6ecaae1c

  • SHA512

    c97a5152d68d2aee74eb5a69a9fe6cdda875ed614c44b21142a2a519a88d8f2239613b7de31c9201a184a62d6ec3096a45eb565976ab726078d6e42e4c5fa758

  • SSDEEP

    196608:qFIAsZlG9mvLSbPpfrw1Hzhj3OTc6sB/0fSpwA:qFnsjaPOxhmcvES

Score
10/10
skuld

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Skuld family
    skuld
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-07-01_bb5921e2714c9a4afd6c0aff97232bbf_ngrbot_poet-rat_snatch
    .exe windows:6 windows x64 arch:x64

    c2d457ad8ac36fc9f18d45bffcd450c2


    Headers

    Imports

    Sections