skuld | a17c45fc676bbd05c956e214bb54a015aa63d4625f92cdb772eca8d7689d7d39 | Triage

Sharing

General

Target

2025-02-27_746082057b72459e5be098886b25e9fc_frostygoop_luca-stealer_ngrbot_poet-rat_sliver_snatch
Size

9.8MB
Sample

250227-bxgtbazvdx
MD5

746082057b72459e5be098886b25e9fc
SHA1

c41e3e1539f2d1b97294dec09e9d96ac67735d3f
SHA256

a17c45fc676bbd05c956e214bb54a015aa63d4625f92cdb772eca8d7689d7d39
SHA512

5332836ebf1384d4f67309498333844a86a9897b3a2e7c9f6d27b005c3ce7f5907ed4a146de583a19485a46cd4b537113e3f268f76d9a05af8fc8af7d12be366
SSDEEP

98304:nQx/3AgFmlCnLGJU08pDYWogWH6tpLECfLg8FBVmLTzaZasa:nQPFmlCnLkwbogWHEpYCR8Tztsa

Score

10^/10

skuld discovery execution spyware stealer

Malware Config

Targets

- Target
  
  2025-02-27_746082057b72459e5be098886b25e9fc_frostygoop_luca-stealer_ngrbot_poet-rat_sliver_snatch
- Size
  
  9.8MB
- MD5
  
  746082057b72459e5be098886b25e9fc
- SHA1
  
  c41e3e1539f2d1b97294dec09e9d96ac67735d3f
- SHA256
  
  a17c45fc676bbd05c956e214bb54a015aa63d4625f92cdb772eca8d7689d7d39
- SHA512
  
  5332836ebf1384d4f67309498333844a86a9897b3a2e7c9f6d27b005c3ce7f5907ed4a146de583a19485a46cd4b537113e3f268f76d9a05af8fc8af7d12be366
- SSDEEP
  
  98304:nQx/3AgFmlCnLGJU08pDYWogWH6tpLECfLg8FBVmLTzaZasa:nQPFmlCnLkwbogWHEpYCR8Tztsa
Score

8^/10

discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryexecutionspywarestealer