Extracted

• • Target

    2024-10-10_da1163cbe0fe34235be01b2779bd47dd_ngrbot_poet-rat_snatch

  • Size

    9.9MB

  • MD5

    da1163cbe0fe34235be01b2779bd47dd

  • SHA1

    b882dfb3a0b6bb414a74a730452de2b249b34902

  • SHA256

    e1aa7ffbe0f7ffe2f2dc5c333d11abbc9792b2e9a4ae8efe7bcaf59ebacd07bf

  • SHA512

    a7bab9a4973a85f6746f027dc68403a636f25130be5e8f84189fb1572fcabfa1360e46a7f5b0d8e17279bf514640c14318e1e368f4fe96f882804ff661cbb267

  • SSDEEP

    98304:BQI9wzKxmhMIIKfGTibiyCC9cK8PE2ICafZmwjsEejd:BIzKxmhhtbiyCicRMDUjd

  Score

  10^/10

  skuldpersistencestealer

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2