skuld | b27bf8c19559b1667bd9dda9bc0e493b0c943a698b94e05dd12b8b659fadf33b

General

Target

2024-09-15_4caa49c56b91366cfb39cd590067a979_ngrbot_poet-rat_snatch
Size

9.9MB
Sample

240915-qtn6jsvhqe
MD5

4caa49c56b91366cfb39cd590067a979
SHA1

8a4d080acae140d2f59923a14aba79fb9c2a6b31
SHA256

b27bf8c19559b1667bd9dda9bc0e493b0c943a698b94e05dd12b8b659fadf33b
SHA512

e5964a9f13282462f4051a8e889e5a534e48147bc4db5f3fe07382d2cb0f744bac9d86b9cc8cf1724b04b0377ec5f1eea1da19b734535a3a5e5b9053cc6c582d
SSDEEP

98304:0QI9wzKxmhMIIKfGTibiyCC9cE8aE2ICafZm7jsEVjd:0IzKxmhhtbiyCicDHDajd

Score

10^/10

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1135938366463029258/vJmeyFxpmZaKbzjPYsSWaz4Wl0kpI1mEtdYVOK105NQx9rzZ1ORARwaZNiuwBNU_zT6t

Targets

- Target
  
  2024-09-15_4caa49c56b91366cfb39cd590067a979_ngrbot_poet-rat_snatch
- Size
  
  9.9MB
- MD5
  
  4caa49c56b91366cfb39cd590067a979
- SHA1
  
  8a4d080acae140d2f59923a14aba79fb9c2a6b31
- SHA256
  
  b27bf8c19559b1667bd9dda9bc0e493b0c943a698b94e05dd12b8b659fadf33b
- SHA512
  
  e5964a9f13282462f4051a8e889e5a534e48147bc4db5f3fe07382d2cb0f744bac9d86b9cc8cf1724b04b0377ec5f1eea1da19b734535a3a5e5b9053cc6c582d
- SSDEEP
  
  98304:0QI9wzKxmhMIIKfGTibiyCC9cE8aE2ICafZm7jsEVjd:0IzKxmhhtbiyCicDHDajd
Score

10^/10

skuld credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Skuld stealer
  An info stealer written in Go lang.
  stealer skuld
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2