Resubmissions

27-10-2024 19:12

241027-xwwrqsyldl 10

27-10-2024 19:12

241027-xwgmta1cle 10

General

  • Target

    RobloxPlayerLauncher.exe

  • Size

    9.9MB

  • Sample

    241027-xwwrqsyldl

  • MD5

    5c5df6c4b78bfb7d355e572b6cfce6d2

  • SHA1

    830265d6a2765a753e9d9dee7b9a889aa025fb5b

  • SHA256

    5c4c6ef3aed460f7ea15025bc160768e00c988747b943c99faf9f09b73f86e18

  • SHA512

    ea058263672e14bd4c3730d471489a04f97ba697eb9fbae4ff5e6c735f3438c99720cbe3a308bd25d081006be54b0ac77c4f43839dd57abb6408e2f4781e7689

  • SSDEEP

    98304:BzU4brhxBASgf/gEpiji6Ig8TWAREIICafZm/mbnXg:BxrhxBAGZji6IdThyRTXg

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1299276926313168939/nUyg4ujtj0ahOQ9bQrsonhIejMu_TEy5WSbSW1zNiMPvu82xYEoKx__3y8ucAcZ122uh

Targets

    • Target

      RobloxPlayerLauncher.exe

    • Size

      9.9MB

    • MD5

      5c5df6c4b78bfb7d355e572b6cfce6d2

    • SHA1

      830265d6a2765a753e9d9dee7b9a889aa025fb5b

    • SHA256

      5c4c6ef3aed460f7ea15025bc160768e00c988747b943c99faf9f09b73f86e18

    • SHA512

      ea058263672e14bd4c3730d471489a04f97ba697eb9fbae4ff5e6c735f3438c99720cbe3a308bd25d081006be54b0ac77c4f43839dd57abb6408e2f4781e7689

    • SSDEEP

      98304:BzU4brhxBASgf/gEpiji6Ig8TWAREIICafZm/mbnXg:BxrhxBAGZji6IdThyRTXg

    • Skuld family

    • Skuld stealer

      An info stealer written in Go lang.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks