Extracted

• • Target

    2025-02-12_af24d11848de1fc38d1cb6c08d36d306_frostygoop_luca-stealer_ngrbot_poet-rat_snatch

  • Size

    14.8MB

  • MD5

    af24d11848de1fc38d1cb6c08d36d306

  • SHA1

    acccb5e04025a64ef4a5c7708588749b04d155ff

  • SHA256

    9583979209fadf3861eff01c297c2d8355e65e75dad1b63cc60f9045b2db966e

  • SHA512

    f17fdb6166390159c5a5c107d64aba54b00567fa701a4f32f2a1a979435e0a0f77ff1d2a9c744b1383e8959f792711bf1ed9e36311f53b802ffc394ba6301bd5

  • SSDEEP

    196608:4qZ4f/oCqKqc/3h4Po95Xx+29GAB7ob73mrVGwYdNE2vfUWf:TZ4XoBKH59AuM73gQDvfUWf

  Score

  10^/10

  skulddiscoverypersistencestealer

  • Skuld family

    skuld

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Downloads MZ/PE file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2