Extracted

• • Target

    2024-10-13_5ef2d4590801769c57ea9b4690dc4a7d_ngrbot_poet-rat_snatch

  • Size

    14.2MB

  • MD5

    5ef2d4590801769c57ea9b4690dc4a7d

  • SHA1

    21a12ed600a2a69cb38091eb75b52c5bfee10c1d

  • SHA256

    48e5cc1db19aacc0b68e6f4d8378fcd833f98cc7606e25a0fc185257332cf532

  • SHA512

    358d4b1d78a7e6f8eabeb622ae6d8fe9d8dd6d2a0e839600ea637c2df42103639e34ac50bc8a7859f621ce858023f7fa527d2081f9c1dd24d200127a0977b99a

  • SSDEEP

    196608:tWJafoL/tUoTX4ZZbh1Yf0k7Ma/rkFlgdTaUrPPbdfw:tWsfm/Mbh1lkSFCdTauZo

  Score

  10^/10

  skuldpersistencestealer

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2