Extracted

• • Target

    2024-11-04_4956affee5ed4d173443c12414e38252_ngrbot_poet-rat_snatch

  • Size

    9.9MB

  • MD5

    4956affee5ed4d173443c12414e38252

  • SHA1

    d5d91b4ceefb867e6ed8cfde02f7fbe4d9407260

  • SHA256

    68bbfd62c700aaaaeb8172c0218e7c63261d159481e4c5518a1d6aadfd357a4d

  • SHA512

    b32c437720a663817cc097594db25479dfce6e1be31005b86acd9bb146a7135a1904d001a62fa8f9199cf38c228210be7689ba95d6c29b6bffc043ab3e916c36

  • SSDEEP

    98304:UzU4brhxBASgf/gEpiji6Ig8TWAFEIICafZm/mbnXg:UxrhxBAGZji6IdTh2RTXg

  Score

  10^/10

  skuldpersistencestealer

  • Skuld family

    skuld

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2