Extracted

• • Target

    2024-10-25_408214e2e5474991acddca75350c23df_ngrbot_poet-rat_snatch

  • Size

    14.2MB

  • MD5

    408214e2e5474991acddca75350c23df

  • SHA1

    196aba366c6fefc2f9075a19186b47319cfd5c3a

  • SHA256

    854dda4311f184951a17cee9b36f40414c8b19808b96daff7b2139f446851a9a

  • SHA512

    171ce4c86cd38cff4403604698207f114b4834b8812de6803d73716fdb83bd72031576f47cb7a89a2203d123f3bc14288c2a229af5be5db3d64c3165fa3e6d8b

  • SSDEEP

    196608:7WJafoL/tUoTX4ZXbh1Yf0k7Ma/rkFlgdTaUrPPbdfw:7Wsfm/6bh1lkSFCdTauZo

  Score

  10^/10

  skuldpersistencestealer

  • Skuld family

    skuld

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2