skuld | 2026-08-03_4ef5311303a599a1388469918701fe16_coinminer_dosia_glassworm_hive_luca-stealer_ngrbot_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_4ef5311303a599a1388469918701fe16_coinminer_dosia_glassworm_hive_luca-stealer_ngrbot_poet-rat_quasar-rat_snatch
Size 10.8MB
Sample260804-de9gqa1bma
SHA256 24624cea24adb8f1d3b9438d413e0107d8fe1511205b94d2d27af1d266de14e1
MD5 4ef5311303a599a1388469918701fe16
SHA1 a2c765fe4b06fac25eb61e4f001cc25e75efe060
SHA512 8acd3bd1f5fd1e6d14ebcffa79a1a6e221d0bccdcf29b980e553a5669f443343fd9bbe416d86b1c3ba562d55fbb52ca920bdf04f3322daf1035b143278b8e106
SSDEEP 98304:3p4ZGfpde99+uon8IhADoNd0hGg41thnOABYxSSE7r:3iupA99+5hMid0h341jOFe7r
TLSH
T124B64A43E8A565E4C0AD9136CE269222BE713C984F3063D32F52F7242F77BD4A9B9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx stealer skuld

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1532430421890170900/DDQFOmFp-QUqKby85TyR6Wd_F4GYBrR5Y50uVgdqLzy63hArJl57rcAhDm9ips6d3QQB

Signatures

Family: Skuld stealer
An info stealer written in Go lang.
stealer skuld

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects SkuldStealer 1 IoCs

resource	yara_rule
sample	family_skuld

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_4ef5311303a599a1388469918701fe16_coinminer_dosia_glassworm_hive_luca-stealer_ngrbot_poet-rat_quasar-rat_snatch

File Explorer

2026-08-03_4ef5311303a599a1388469918701fe16_coinminer_dosia_glassworm_hive_luca-stealer_ngrbot_poet-rat_quasar-rat_snatch

.exe 10.8MB

2026-08-03_4ef5311303a599a1388469918701fe16_coinminer_dosia_glassworm_hive_luca-stealer_ngrbot_poet-rat_quasar-rat_snatch

SHA256 24624cea24adb8f1d3b9438d413e0107d8fe1511205b94d2d27af1d266de14e1
MD5 4ef5311303a599a1388469918701fe16
SHA1 a2c765fe4b06fac25eb61e4f001cc25e75efe060
SHA512 8acd3bd1f5fd1e6d14ebcffa79a1a6e221d0bccdcf29b980e553a5669f443343fd9bbe416d86b1c3ba562d55fbb52ca920bdf04f3322daf1035b143278b8e106
SSDEEP 98304:3p4ZGfpde99+uon8IhADoNd0hGg41thnOABYxSSE7r:3iupA99+5hMid0h341jOFe7r
TLSH
T124B64A43E8A565E4C0AD9136CE269222BE713C984F3063D32F52F7242F77BD4A9B9750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects SkuldStealer
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables containing URLs to raw contents of a Github gist
Detects executables containing possible sandbox system UUIDs
Detects executables referencing virtualization MAC addresses
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

508416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths