General

  • Target

    2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch

  • Size

    9.5MB

  • Sample

    240730-artp9aycqk

  • MD5

    3cf1e06121b623d2a8aa1b87317f2862

  • SHA1

    a328d0b8f5fddb5329120a42c8b4d8d454df0cc7

  • SHA256

    6a84fa6d9ada7d92608a8151e717bffcc2e10a076f6b49786475f810391d92e9

  • SHA512

    6b406234e4bdd1364e7255de3483cb14b556fa0dcd1e84d0f2151b4dffda4c259d25aa2267aab80a781e46c4ca967634e5a335b07933cee04fb3977ee9fc8c32

  • SSDEEP

    98304:QStuP4FfFJpqQvLmaYocohCn+ziEhW7F/82HIP:5EMfFvZYocoYn+zvhQHIP

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1267254147871412244/mw3axCfBQQXK_ENvEh48DrzPLTmIcxCeHKBLTmzDTtWSrCuuPad1GmQz-Pd1TOPRUnu9

Targets

    • Target

      2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch

    • Size

      9.5MB

    • MD5

      3cf1e06121b623d2a8aa1b87317f2862

    • SHA1

      a328d0b8f5fddb5329120a42c8b4d8d454df0cc7

    • SHA256

      6a84fa6d9ada7d92608a8151e717bffcc2e10a076f6b49786475f810391d92e9

    • SHA512

      6b406234e4bdd1364e7255de3483cb14b556fa0dcd1e84d0f2151b4dffda4c259d25aa2267aab80a781e46c4ca967634e5a335b07933cee04fb3977ee9fc8c32

    • SSDEEP

      98304:QStuP4FfFJpqQvLmaYocohCn+ziEhW7F/82HIP:5EMfFvZYocoYn+zvhQHIP

    • Skuld stealer

      An info stealer written in Go lang.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

MITRE ATT&CK Enterprise v15

Tasks