skuld | 2026-07-22_13a3bbc0e29ec7c1daa8eac1f48310c8_coinminer_dosia_glassworm_hive_luca-stealer_ngrbot_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_13a3bbc0e29ec7c1daa8eac1f48310c8_coinminer_dosia_glassworm_hive_luca-stealer_ngrbot_poet-rat_quasar-rat_snatch
Size 10.3MB
Sample260723-an6weaec88
SHA256 17d868554a48514a0b4adcaf1ae8dd520f2be37c51bda4a994024257a47a3b7b
MD5 13a3bbc0e29ec7c1daa8eac1f48310c8
SHA1 5e9ee38f7619018a8cd885e750503760a18ed5ed
SHA512 2527880ed0cb33a74637f40760db9a55b35266498563e2234e6145e8bddf2c6ddd5dbb37464da6ad7f92f18183d7771479fbdf975772440d4fdf4739e49817ff
SSDEEP 98304:zGlXQbXPxwVKnM1itd0ubsQPDcMfELYWGgbZmBOD1:zGWXPxwUnvlbsQPAM8LrjD
TLSH
T1B6B64947E8A541A4C0ADA175CA269623BF713C988F3063D36F50F7646FB7BD0AA79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx stealer skuld

Malware Config

Signatures

Family: Skuld stealer
An info stealer written in Go lang.
stealer skuld

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects SkuldStealer 1 IoCs

resource	yara_rule
sample	family_skuld

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_13a3bbc0e29ec7c1daa8eac1f48310c8_coinminer_dosia_glassworm_hive_luca-stealer_ngrbot_poet-rat_quasar-rat_snatch

File Explorer

2026-07-22_13a3bbc0e29ec7c1daa8eac1f48310c8_coinminer_dosia_glassworm_hive_luca-stealer_ngrbot_poet-rat_quasar-rat_snatch

.exe 10.3MB

2026-07-22_13a3bbc0e29ec7c1daa8eac1f48310c8_coinminer_dosia_glassworm_hive_luca-stealer_ngrbot_poet-rat_quasar-rat_snatch

SHA256 17d868554a48514a0b4adcaf1ae8dd520f2be37c51bda4a994024257a47a3b7b
MD5 13a3bbc0e29ec7c1daa8eac1f48310c8
SHA1 5e9ee38f7619018a8cd885e750503760a18ed5ed
SHA512 2527880ed0cb33a74637f40760db9a55b35266498563e2234e6145e8bddf2c6ddd5dbb37464da6ad7f92f18183d7771479fbdf975772440d4fdf4739e49817ff
SSDEEP 98304:zGlXQbXPxwVKnM1itd0ubsQPDcMfELYWGgbZmBOD1:zGWXPxwUnvlbsQPAM8LrjD
TLSH
T1B6B64947E8A541A4C0ADA175CA269623BF713C988F3063D36F50F7646FB7BD0AA79700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects SkuldStealer
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables containing URLs to raw contents of a Github gist
Detects executables containing possible sandbox system UUIDs
Detects executables referencing virtualization MAC addresses
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

477312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths