Extracted

• • Target
    2026-07-25_599df37fbb8a1f660f2ca43a2bf0e8aa_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
  • Size 10.6MB
  • SHA256 ee3b59f29038c047de7836df9016b4ea5499125d2e0d94706abbf56413cf1fce
  • MD5 599df37fbb8a1f660f2ca43a2bf0e8aa
  • SHA1 952d34a3cc80250c75db43c68ee7e5fa90333125
  • SHA512 e4b5ed67e8950881fac23a1a285037449197bf6a87b22d27bfe7cc2e5410352c9794c19a8484f5272fba6e4ed3bdc23fc19a432038be89f3e7d7a9ae1da2f23f
  • SSDEEP 98304:+9jcZGqNxq4r6sTsia8p0ecQvqRwfojO6tEfn:+G8m218p0jQvqRHAfn
  • TLSH
    T15AB64957ECA541E8C0ADD175CA669262BF713C885B3063D36B50F6282F37BE0ADB9740
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionskuldpersistencestealer

  • Detects SkuldStealer

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2