Extracted

• • Target

    2024-10-15_ab36761933c5bb4881dac471eda52d2a_ngrbot_poet-rat_snatch

  • Size

    9.9MB

  • MD5

    ab36761933c5bb4881dac471eda52d2a

  • SHA1

    5564d033cfe34b44780f38729990e574b14096e6

  • SHA256

    f2b5a3386be42bcfcd51a8b315fa95d68cb5b04cd50d2c011a21c798ab1c006d

  • SHA512

    9369dcbec8299c518859f9bcfee17b0147163694cc057aaf703bea66a20da532e11b8f1ffefb7941f49f24376e1f0b645196a81c0bb6eb8ad592a8486625fc58

  • SSDEEP

    98304:NQI9wzKxmhMIIKfGTibiyCC9cK8hE2ICafZmwjsEejd:NIzKxmhhtbiyCicRiDUjd

  Score

  10^/10

  skuldpersistencestealer

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2