Extracted

• • Target

    slinky.exe

  • Size

    14.2MB

  • MD5

    594656d7741bdf54df99d5b8e7262fae

  • SHA1

    ada692f9ce98a7aeb191c6056b99ceb0316ea7ca

  • SHA256

    87f5cf612d37b2728d5be155ab9cde88f6e3533e2f3a5d54f525e36efee5ebb9

  • SHA512

    93d2b7f3b61e9bbae30475e83e8cb01aeea56e57f87593c1b02697089a944ae80321fb7ec3c743ef3eb7fe7a0ffb2a221f088dda41564fa099891a36c8f5ccf6

  • SSDEEP

    196608:RWJafoL/tUoTX4Z1bh1Yf0k7Ma/rkFlgdTaUrPPbdfw:RWsfm/Ybh1lkSFCdTauZo

  Score

  10^/10

  skuldexecutionpersistenceprivilege_escalationspywarestealer

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1