Overview

overview

10

Static

static

10

RealtekHDA...er.exe

windows10-1703-x64

10

RealtekHDA...er.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RealtekHDAudioManager.exe

  • Size

    9.9MB

  • Sample

    240908-ks1kasyfpg

  • MD5

    66dcb8e404e39465f21e8c17c223cbce

  • SHA1

    7e2f220191e06da058b76257e71c707378721c4f

  • SHA256

    80b9912b40dbbba68f9b83c2f18495149cc120a285ab7fae0a333e223412eb3f

  • SHA512

    85a0bd29d8ed2f77d561b9c60565a11defe65885ef5783d77ea13b374bf3d5b0cf10fa996d623e526faf65e3b7ab2423ff3810638c18c32a9936b8a2d5a80164

  • SSDEEP

    98304:6QI9wzKxmhMIIKfGTibiyCC9cK8yE2ICafZmwjsEejd:6IzKxmhhtbiyCicRfDUjd

Score
10/10
skuldpersistencestealer

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1281798080831684654/97q8rBV9oGoDnjnN72iLt4FY_BkQfULH9HMX-mbmcq4SFeqjHV9Up44HYqKZGhBj6eoL

Targets

    • Target

      RealtekHDAudioManager.exe

    • Size

      9.9MB

    • MD5

      66dcb8e404e39465f21e8c17c223cbce

    • SHA1

      7e2f220191e06da058b76257e71c707378721c4f

    • SHA256

      80b9912b40dbbba68f9b83c2f18495149cc120a285ab7fae0a333e223412eb3f

    • SHA512

      85a0bd29d8ed2f77d561b9c60565a11defe65885ef5783d77ea13b374bf3d5b0cf10fa996d623e526faf65e3b7ab2423ff3810638c18c32a9936b8a2d5a80164

    • SSDEEP

      98304:6QI9wzKxmhMIIKfGTibiyCC9cK8yE2ICafZmwjsEejd:6IzKxmhhtbiyCicRfDUjd

    Score
    10/10
    skuldpersistencestealer

    • Skuld stealer

      An info stealer written in Go lang.

      stealerskuld

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks