Extracted

• • Target

    scrim mod.exe

  • Size

    3.2MB

  • MD5

    8b18c1414d646cd4138db5c1b67c318a

  • SHA1

    58642571e177880cd319d2b6777ea4350845a199

  • SHA256

    1039ecbae09ab86703af4ddaef7e9cab739b75d1adb0879914389cee7683bd6f

  • SHA512

    8f273ecf086f3e21adccb8581ef0e047d1594ae6c7344a004bc1454497edc33a5b51fa7085e31808293ac5a8e210a3a158fa755d930b2057d9dd078bb35ede16

  • SSDEEP

    98304:WfzzQtNrIU8czmxnPCObnlItD60EiBmW/avuhF:iQNCxnPpJItD6Zi8uX

  Score

  10^/10

  skuldpersistencestealerupx

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1