General

  • Target

    OperaGXX.exe

  • Size

    9.8MB

  • Sample

    241208-ty322synfz

  • MD5

    e70c39d1f1ac0e52fcc52d64fa871f30

  • SHA1

    f17425132831a1ad0a112c75b7a7f04fed73c965

  • SHA256

    1ef1e0470f27e25343087cd3ae225d4dd8711a31f308b314b83affe57b3181bb

  • SHA512

    50d4e45b23b50b531b6d1db7bbb8683a427b9060df77cd993bd6ef36163f44d882985c3217a4d15fab8e53437582d670da7549778918f5c0d68205b61794fb69

  • SSDEEP

    98304:hH6fVmD1C2gnoWoS7Kr7Eg7ru9MvE9pRD4Z4S5bovr:hH31C2bSI7Eg7ySsqBRovr

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1313142704439427092/YKwWrnk0E-QciBzXVfcEmZg-CAYCUchZuAphpzY_DvCmjRKFsYGLIEowP8dExV6arEe2

Targets

    • Target

      OperaGXX.exe

    • Size

      9.8MB

    • MD5

      e70c39d1f1ac0e52fcc52d64fa871f30

    • SHA1

      f17425132831a1ad0a112c75b7a7f04fed73c965

    • SHA256

      1ef1e0470f27e25343087cd3ae225d4dd8711a31f308b314b83affe57b3181bb

    • SHA512

      50d4e45b23b50b531b6d1db7bbb8683a427b9060df77cd993bd6ef36163f44d882985c3217a4d15fab8e53437582d670da7549778918f5c0d68205b61794fb69

    • SSDEEP

      98304:hH6fVmD1C2gnoWoS7Kr7Eg7ru9MvE9pRD4Z4S5bovr:hH31C2bSI7Eg7ySsqBRovr

    • Skuld family

    • Skuld stealer

      An info stealer written in Go lang.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.