Extracted

• • Target

    skuld.exe

  • Size

    10.3MB

  • MD5

    0413b8b0aa1528459d056f9776e335c8

  • SHA1

    452d23e62183e92bd349b0204468a1e4fb2896c4

  • SHA256

    6704e7013687a9a0c7787b5edffdfc87246eda472cfa885469ee8fc6d0fe19ea

  • SHA512

    c5a36a4a29d616c9af2038b03a15b7f91e058501ea34afb84d1dd04e11a3eb0cf17a09d25d41a37367506bcd0193c8df1cd571fd9985528667cb527fe0770286

  • SSDEEP

    98304:HOBUlG77NlZFwclKKjYJ5Uz5epeFA0rNlhEH7m:HsN5wcu5Uz5epTuiH7

  Score

  8^/10

  adwarediscoverypersistenceprivilege_escalationstealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1