skuld | 0cdf178028f1f8467372158288bec5a6b2a1c3ff9107adc16b3403834aacd84e

General

Target

2024-08-29_f7acb232a20cc906ea7f483579dea1cd_ngrbot_poet-rat_snatch
Size

9.5MB
Sample

240829-a4fn6axaml
MD5

f7acb232a20cc906ea7f483579dea1cd
SHA1

96d52266fcd1cf051709e3c96968ab2f1dfaf94b
SHA256

0cdf178028f1f8467372158288bec5a6b2a1c3ff9107adc16b3403834aacd84e
SHA512

000756041cc76006fcc004515a93e28d43c49083ce7fa4fc8b15febe9f06a39e2dcbe3dbbc1f5a600df4cb41cac6a9351e41eef16922c783debbb26394240876
SSDEEP

98304:m/BtGspfDDm1tnoFVoWQ5JFO29Et77F/Bz2OIi:6I0fDhVoWQvFO2utz1Ii

Score

10^/10

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1259501803045654570/75nMDUd8tUBH4dq2un2_u7hedzL05JWneGIa2IxO45f9rRusN_24AXMRtGoy_ae99OCb

Targets

- Target
  
  2024-08-29_f7acb232a20cc906ea7f483579dea1cd_ngrbot_poet-rat_snatch
- Size
  
  9.5MB
- MD5
  
  f7acb232a20cc906ea7f483579dea1cd
- SHA1
  
  96d52266fcd1cf051709e3c96968ab2f1dfaf94b
- SHA256
  
  0cdf178028f1f8467372158288bec5a6b2a1c3ff9107adc16b3403834aacd84e
- SHA512
  
  000756041cc76006fcc004515a93e28d43c49083ce7fa4fc8b15febe9f06a39e2dcbe3dbbc1f5a600df4cb41cac6a9351e41eef16922c783debbb26394240876
- SSDEEP
  
  98304:m/BtGspfDDm1tnoFVoWQ5JFO29Et77F/Bz2OIi:6I0fDhVoWQvFO2utz1Ii
Score

10^/10

skuld credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Skuld stealer
  An info stealer written in Go lang.
  stealer skuld
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2