skuld | 03da816f34074a5e1941ababc4cbab2880d149a03b1b3b1000cf065479d50272

General

Target

2024-09-03_59a08bb8bf4881e814fd3d36f525da8a_ngrbot_poet-rat_snatch
Size

14.2MB
Sample

240903-asdqessgpc
MD5

59a08bb8bf4881e814fd3d36f525da8a
SHA1

3f542be6b20daef732a4c4bee9bad1dde8b375f0
SHA256

03da816f34074a5e1941ababc4cbab2880d149a03b1b3b1000cf065479d50272
SHA512

dfc2c2a0c743918642943d296c3b26367d80ce49d3c0ee099c27398ed134a965203014b1b0346e41d882531f8d0bdb878cc38ee1c2420844bd9cfd70677e002a
SSDEEP

196608:oWJafoL/tUoTX4Z8bh1Yf0k7Ma/rkFlgdTaUrPPbdfw:oWsfm/Vbh1lkSFCdTauZo

Score

10^/10

Malware Config

Extracted

Family

skuld

C2

https://ptb.discord.com/api/webhooks/1277694857338687561/FxXidvF_Xcdm1mFBnfMwjGWhByymrClV-px0CZhfTr9YtQWuA8etVIU6_PpLcbsJWD9d

Targets

- Target
  
  2024-09-03_59a08bb8bf4881e814fd3d36f525da8a_ngrbot_poet-rat_snatch
- Size
  
  14.2MB
- MD5
  
  59a08bb8bf4881e814fd3d36f525da8a
- SHA1
  
  3f542be6b20daef732a4c4bee9bad1dde8b375f0
- SHA256
  
  03da816f34074a5e1941ababc4cbab2880d149a03b1b3b1000cf065479d50272
- SHA512
  
  dfc2c2a0c743918642943d296c3b26367d80ce49d3c0ee099c27398ed134a965203014b1b0346e41d882531f8d0bdb878cc38ee1c2420844bd9cfd70677e002a
- SSDEEP
  
  196608:oWJafoL/tUoTX4Z8bh1Yf0k7Ma/rkFlgdTaUrPPbdfw:oWsfm/Vbh1lkSFCdTauZo
Score

10^/10

skuld credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Skuld stealer
  An info stealer written in Go lang.
  stealer skuld
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2