General

  • Target

    2025-04-06_ad52dae706895fc13fb657541ec114f2_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch

  • Size

    10.3MB

  • Sample

    250406-behmwsywhx

  • MD5

    ad52dae706895fc13fb657541ec114f2

  • SHA1

    592c57f7ce3b5a1104194eb19203307d7e8a0d41

  • SHA256

    3c6e92391627b19f3a159cdfb4ef0d1e0780d7d35855d4e6a18a4222803ec1c5

  • SHA512

    8b63177a05baaebf0e9b4d349e66332f9a0da5efa57cf3fbcd4f7dbe3855b5cba403b096c5358ebe5c2b852f8cd568ebfafc0a74283b4e32af5ca8f8500b323e

  • SSDEEP

    98304:FSBHmZmU00lRr5Yizfw0NbxbABrUhUh6Erb7:FgHmZL00lzfw0NbxsRnrb7

Malware Config

Extracted

Family

skuld

C2

https://canary.discord.com/api/webhooks/1358117404437385367/QQNiA5kyS5sbwK56ovMrHvtxsPIkBEnnfPulKi5ZVjah9msoGG3tzWJm_sHQcdYPo5Lm

Targets

    • Target

      2025-04-06_ad52dae706895fc13fb657541ec114f2_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch

    • Size

      10.3MB

    • MD5

      ad52dae706895fc13fb657541ec114f2

    • SHA1

      592c57f7ce3b5a1104194eb19203307d7e8a0d41

    • SHA256

      3c6e92391627b19f3a159cdfb4ef0d1e0780d7d35855d4e6a18a4222803ec1c5

    • SHA512

      8b63177a05baaebf0e9b4d349e66332f9a0da5efa57cf3fbcd4f7dbe3855b5cba403b096c5358ebe5c2b852f8cd568ebfafc0a74283b4e32af5ca8f8500b323e

    • SSDEEP

      98304:FSBHmZmU00lRr5Yizfw0NbxbABrUhUh6Erb7:FgHmZL00lzfw0NbxsRnrb7

    • Skuld family

    • Skuld stealer

      An info stealer written in Go lang.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks