Extracted

• • Target
    2026-07-29_31bd1ff70727e6441769a4c61a168d55_hive
  • Size 3.3MB
  • SHA256 2e6ac211811fe7270704516fc7359077a111a6604a0ff223ebce7fb940124250
  • MD5 31bd1ff70727e6441769a4c61a168d55
  • SHA1 44eb042f02db04a000a4b2748e7bca70b4ff418f
  • SHA512 f8f4d2b71ba6871064e42332771eb52060124f261d673f2bcc803baefb2691acf3faaf40b2f09f29b80a9dbcc3bff0d8ddc0bcdb2eef11628334ab2c41b5ba56
  • SSDEEP 98304:za0LO//x9TZRhz+zudAMKUCZNt7x9VnYM:O0i/vZRQugZNt7RnY
  • TLSH
    T107F533F7BD357664C72CE43294FBA9242A650CCDAE612FCBBC187444F5897FAE140A81
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryskuldpersistencestealerupx

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables Discord URL observed in first stage droppers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables referencing virtualization MAC addresses

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2