General
- Target 2026-07-20_f403ecc87f9bd02081587207228e8813_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 10.6MB
- Sample260720-xcvqbsdv71
- SHA256 7e4014abc8cc94d2f36b992866d85bec93ff7323bcc20d70e4b89a3c5bb40e1c
Score
10/10
Malware Config
Targets
-
- Target 2026-07-20_f403ecc87f9bd02081587207228e8813_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 10.6MB
- SHA256 7e4014abc8cc94d2f36b992866d85bec93ff7323bcc20d70e4b89a3c5bb40e1c
Score10/10-
Detects SkuldStealer
-
Family: Skuld stealer
An info stealer written in Go lang.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing possible sandbox system UUIDs
-
Detects executables referencing virtualization MAC addresses
-
Detects executables using Telegram Chat Bot
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.