skuld | 80b9912b40dbbba68f9b83c2f18495149cc120a285ab7fae0a333e223412eb3f

General

Target

2024-09-10_66dcb8e404e39465f21e8c17c223cbce_ngrbot_poet-rat_snatch
Size

9.9MB
Sample

240910-kcrmfswcmc
MD5

66dcb8e404e39465f21e8c17c223cbce
SHA1

7e2f220191e06da058b76257e71c707378721c4f
SHA256

80b9912b40dbbba68f9b83c2f18495149cc120a285ab7fae0a333e223412eb3f
SHA512

85a0bd29d8ed2f77d561b9c60565a11defe65885ef5783d77ea13b374bf3d5b0cf10fa996d623e526faf65e3b7ab2423ff3810638c18c32a9936b8a2d5a80164
SSDEEP

98304:6QI9wzKxmhMIIKfGTibiyCC9cK8yE2ICafZmwjsEejd:6IzKxmhhtbiyCicRfDUjd

Score

10^/10

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1281798080831684654/97q8rBV9oGoDnjnN72iLt4FY_BkQfULH9HMX-mbmcq4SFeqjHV9Up44HYqKZGhBj6eoL

Targets

- Target
  
  2024-09-10_66dcb8e404e39465f21e8c17c223cbce_ngrbot_poet-rat_snatch
- Size
  
  9.9MB
- MD5
  
  66dcb8e404e39465f21e8c17c223cbce
- SHA1
  
  7e2f220191e06da058b76257e71c707378721c4f
- SHA256
  
  80b9912b40dbbba68f9b83c2f18495149cc120a285ab7fae0a333e223412eb3f
- SHA512
  
  85a0bd29d8ed2f77d561b9c60565a11defe65885ef5783d77ea13b374bf3d5b0cf10fa996d623e526faf65e3b7ab2423ff3810638c18c32a9936b8a2d5a80164
- SSDEEP
  
  98304:6QI9wzKxmhMIIKfGTibiyCC9cK8yE2ICafZmwjsEejd:6IzKxmhhtbiyCicRfDUjd
Score

10^/10

skuld credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Skuld stealer
  An info stealer written in Go lang.
  stealer skuld
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2