Extracted

• • Target
    2026-07-23_fcffee2aa36d519ced7397b04d24cfac_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_ngrbot_poet-rat_quasar-rat_salatstealer_sliver_snatch
  • Size 10.4MB
  • SHA256 3b37a4d1ca824ec8823897c2918855e94715723cfcec2aaedbf6c5225590b2ac
  • MD5 fcffee2aa36d519ced7397b04d24cfac
  • SHA1 d343f1e8627ac235c33cdcdbacb861c862692533
  • SHA512 ea0d0cc65bb50f81838c0cd04e2ca9e797594f0d91a23481c8b1f43a489fa54424e51f4b6fc22e90c4b1154eb58fd35b48ab3827708da3517782d315d8bc3878
  • SSDEEP 98304:QkPB2A0CzhjakJuw4JjXw+iypmkCZnkuCssiwCB1S8EAz:Q1A0CtjavN+A1CZnjCfpMS1Az
  • TLSH
    T102B64A57ECA145E5C0AAD575CA269223BE713C884F3063E76B60F7242F72BD0AE79740
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionskuldpersistencestealer

  • Detects SkuldStealer

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables Discord URL observed in first stage droppers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables referencing virtualization MAC addresses

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2