skuld | c2cc9e7666c1a79f9b7672e116cfa3b51c4a1e690fbc84b09ff0d438fe8497ba

General

Target

2024-09-07_92ef88261af75aafd96f9a2b028433da_ngrbot_poet-rat_snatch
Size

9.8MB
Sample

240907-nhv4lssaqd
MD5

92ef88261af75aafd96f9a2b028433da
SHA1

3eac03cdb97d7af990153fd1ec82dbc6874280d7
SHA256

c2cc9e7666c1a79f9b7672e116cfa3b51c4a1e690fbc84b09ff0d438fe8497ba
SHA512

aa224e0a699fc15dd2aa732664c27ca56c8acfab734b7526369d7aca78b845b8e8a62c7ac3cd4c3010435e9c4643eff90156811f221de8ff81de6cb015ea4a2c
SSDEEP

98304:ZNnNcXWKf3P+HUOQQcObalw70WN1aeAXIE/OTThZ4grN:ZAFf3PA5alw7pN1aeAXhWXrN

Score

10^/10

Malware Config

Targets

- Target
  
  2024-09-07_92ef88261af75aafd96f9a2b028433da_ngrbot_poet-rat_snatch
- Size
  
  9.8MB
- MD5
  
  92ef88261af75aafd96f9a2b028433da
- SHA1
  
  3eac03cdb97d7af990153fd1ec82dbc6874280d7
- SHA256
  
  c2cc9e7666c1a79f9b7672e116cfa3b51c4a1e690fbc84b09ff0d438fe8497ba
- SHA512
  
  aa224e0a699fc15dd2aa732664c27ca56c8acfab734b7526369d7aca78b845b8e8a62c7ac3cd4c3010435e9c4643eff90156811f221de8ff81de6cb015ea4a2c
- SSDEEP
  
  98304:ZNnNcXWKf3P+HUOQQcObalw70WN1aeAXIE/OTThZ4grN:ZAFf3PA5alw7pN1aeAXhWXrN
Score

10^/10

skuld credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Skuld stealer
  An info stealer written in Go lang.
  stealer skuld
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2