Extracted

• • Target

    2024-11-03_5c5df6c4b78bfb7d355e572b6cfce6d2_ngrbot_poet-rat_snatch

  • Size

    9.9MB

  • MD5

    5c5df6c4b78bfb7d355e572b6cfce6d2

  • SHA1

    830265d6a2765a753e9d9dee7b9a889aa025fb5b

  • SHA256

    5c4c6ef3aed460f7ea15025bc160768e00c988747b943c99faf9f09b73f86e18

  • SHA512

    ea058263672e14bd4c3730d471489a04f97ba697eb9fbae4ff5e6c735f3438c99720cbe3a308bd25d081006be54b0ac77c4f43839dd57abb6408e2f4781e7689

  • SSDEEP

    98304:BzU4brhxBASgf/gEpiji6Ig8TWAREIICafZm/mbnXg:BxrhxBAGZji6IdThyRTXg

  Score

  10^/10

  skuldpersistencestealer

  • Skuld family

    skuld

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2