Extracted

• • Target
    2026-08-03_4ef5311303a599a1388469918701fe16_coinminer_dosia_glassworm_hive_luca-stealer_ngrbot_poet-rat_quasar-rat_snatch
  • Size 10.8MB
  • SHA256 24624cea24adb8f1d3b9438d413e0107d8fe1511205b94d2d27af1d266de14e1
  • MD5 4ef5311303a599a1388469918701fe16
  • SHA1 a2c765fe4b06fac25eb61e4f001cc25e75efe060
  • SHA512 8acd3bd1f5fd1e6d14ebcffa79a1a6e221d0bccdcf29b980e553a5669f443343fd9bbe416d86b1c3ba562d55fbb52ca920bdf04f3322daf1035b143278b8e106
  • SSDEEP 98304:3p4ZGfpde99+uon8IhADoNd0hGg41thnOABYxSSE7r:3iupA99+5hMid0h341jOFe7r
  • TLSH
    T124B64A43E8A565E4C0AD9136CE269222BE713C984F3063D32F52F7242F77BD4A9B9750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  skuldstealerupx

  • Detects SkuldStealer

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables Discord URL observed in first stage droppers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables referencing virtualization MAC addresses

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2