Extracted

• • Target

    Spotube-windows-x86_64-setup.exe

  • Size

    29.1MB

  • MD5

    2b532f23ca05059218a0edea60c4b3d3

  • SHA1

    54db672cc861a34b22b0814357d5e0da95945c18

  • SHA256

    d0e1a282d89b59d99c518a8d8de14cb3cfd1ba02f8ac2ad2cfe06f38004618e7

  • SHA512

    a5a363cd50837302fd1ca092387360c0eef084e1daa442320aa616e5a88f901d083e56ef65c63ade75ffad146dfcdcb19ea19f7195f4a781702964f794ba941c

  • SSDEEP

    786432:NwuEzgAZn+KLHFt00TYOzU1EQwG0qDkMlAm:Nwusn+KLHgwYSJ9bqDTlAm

  Score

  10^/10

  skulddefense_evasiondiscoverypersistenceprivilege_escalationstealer

  • Skuld family

    skuld

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1