General
-
Target
skuld.exe
-
Size
9.8MB
-
Sample
241017-ccnxkazclk
-
MD5
5dfbfbeee326774fbe1a4f95b7f3ec2f
-
SHA1
4579782a8211a8ad0bda7373262cdf31c3732625
-
SHA256
dbcee37435b7f1b17fb9ada2e540d0399ad1752146b70a2e515f1135950d3c5c
-
SHA512
65bbad6889a84ceb0505b5cc81277bc1349ab82d14c5b796620ef61835e92e97e0ad58de4cec3156afa75c9655ef3dc211f5071f6d185abb9b31891ae182f9af
-
SSDEEP
98304:+P5vFPKuw+PgryixIqqj+GNTEbBOZ/Zm3vw:+PjKuwKRqqj+8AUEw
Behavioral task
behavioral1
Sample
skuld.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
skuld.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
skuld
https://discord.com/api/webhooks/1296277918661738547/GvUWEusnErfhpdvz7DEgE8VzXSZ8oWS_ujEIVSB0XhETe5iWx3tB8zm_wjAS1bJTlXLF
Targets
-
-
Target
skuld.exe
-
Size
9.8MB
-
MD5
5dfbfbeee326774fbe1a4f95b7f3ec2f
-
SHA1
4579782a8211a8ad0bda7373262cdf31c3732625
-
SHA256
dbcee37435b7f1b17fb9ada2e540d0399ad1752146b70a2e515f1135950d3c5c
-
SHA512
65bbad6889a84ceb0505b5cc81277bc1349ab82d14c5b796620ef61835e92e97e0ad58de4cec3156afa75c9655ef3dc211f5071f6d185abb9b31891ae182f9af
-
SSDEEP
98304:+P5vFPKuw+PgryixIqqj+GNTEbBOZ/Zm3vw:+PjKuwKRqqj+8AUEw
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1