General

  • Target

    Nitro Gen V2.exe

  • Size

    9.5MB

  • Sample

    240807-m646ra1cph

  • MD5

    ccc6a0807556e22d9291c466779f44d1

  • SHA1

    2b6bbbdf647e6bfc517fd58dcc2a774c248ef0e6

  • SHA256

    d2d887cd72c35f65a3f0a506e1abeaf3af3d106704d87d85a0f8c1aa8f693a79

  • SHA512

    6ca7ecfb2d8a31d41d09b5f4a7550351de2f9bde1398ad733e86a28527b637698e7f9858c256e6b7c5745ab3342b987969b484ce7b71c5cdefcbd69443136b5f

  • SSDEEP

    98304:MLhl+t9w5GRLGL+LhoE+3K4+lkHE/Bf7F/Bz2LIb:kQt9w5MhoE+64+lkk/BjkIb

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1270694106221252608/DhcaVtra6YX01ZXjUB1RkOdEw0VBFLhDmXKND_Sz6kXglun1ah1Kgr5PCtFoeWId1QLc

Targets

    • Target

      Nitro Gen V2.exe

    • Size

      9.5MB

    • MD5

      ccc6a0807556e22d9291c466779f44d1

    • SHA1

      2b6bbbdf647e6bfc517fd58dcc2a774c248ef0e6

    • SHA256

      d2d887cd72c35f65a3f0a506e1abeaf3af3d106704d87d85a0f8c1aa8f693a79

    • SHA512

      6ca7ecfb2d8a31d41d09b5f4a7550351de2f9bde1398ad733e86a28527b637698e7f9858c256e6b7c5745ab3342b987969b484ce7b71c5cdefcbd69443136b5f

    • SSDEEP

      98304:MLhl+t9w5GRLGL+LhoE+3K4+lkHE/Bf7F/Bz2LIb:kQt9w5MhoE+64+lkk/BjkIb

    • Skuld stealer

      An info stealer written in Go lang.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks