General
-
Target
skuld.exe
-
Size
9.5MB
-
Sample
240524-r9knqshg8t
-
MD5
890edd42dd5c1b147de66f9ee7dddc27
-
SHA1
931bc48e9547e896de5e9e8b9549c396a2e11aba
-
SHA256
1ac839f45a2ddad20559c6fe53df1135aa1368f0b46a6efff1b257922f000d28
-
SHA512
90af8949001c772e80692b79a2cb11ea54f56bf03a031473c9716785edd2053e6fb0ed3a096ff88476d353a0935e136edb44a516509730c88c00b0a4e8dbce49
-
SSDEEP
98304:25HOIhoB0mnl0l7t4qheyrVX53+9pENvGF8YfD:Gn80Q2beyrVp+9qNsD
Static task
static1
Behavioral task
behavioral1
Sample
skuld.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
skuld.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
skuld.exe
-
Size
9.5MB
-
MD5
890edd42dd5c1b147de66f9ee7dddc27
-
SHA1
931bc48e9547e896de5e9e8b9549c396a2e11aba
-
SHA256
1ac839f45a2ddad20559c6fe53df1135aa1368f0b46a6efff1b257922f000d28
-
SHA512
90af8949001c772e80692b79a2cb11ea54f56bf03a031473c9716785edd2053e6fb0ed3a096ff88476d353a0935e136edb44a516509730c88c00b0a4e8dbce49
-
SSDEEP
98304:25HOIhoB0mnl0l7t4qheyrVX53+9pENvGF8YfD:Gn80Q2beyrVp+9qNsD
Score8/10-
Drops file in Drivers directory
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Hide Artifacts
1Hidden Files and Directories
1