skuld | 2026-08-03_5b50233f6f3cee343e4106256fd8d11a_coinminer_dosia_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_5b50233f6f3cee343e4106256fd8d11a_coinminer_dosia_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch
Size 13.7MB
Sample260804-ny1n2avycx
SHA256 52efffd581538662bb8b93bc80a4b27fcfa0bb21f08348cf0e960efe6332145d
MD5 5b50233f6f3cee343e4106256fd8d11a
SHA1 e394693c4d80e92fd085c0a7f1559c986b79b905
SHA512 d60c0cc2d327eb0423800ef481bc76c3d0d2451d75fcffb20b211057cc2c5102e6fe552353be0932a6c2b91dc09db9a2dde052c610cfc3b920b14fafcefe3884
SSDEEP 98304:a2MxjftTK0UJY105l3rLemdLvqBQONfoA+ltExP:aB7t4JxrLeGLvqB1yr+xP
TLSH
T179E64B53ECB51198E0AD9575C6239663BBB13C894B3063D31B90F7252F37BD0AABA740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx stealer skuld

Malware Config

Signatures

Family: Skuld stealer
An info stealer written in Go lang.
stealer skuld

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects SkuldStealer 1 IoCs

resource	yara_rule
sample	family_skuld

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_5b50233f6f3cee343e4106256fd8d11a_coinminer_dosia_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch

File Explorer

2026-08-03_5b50233f6f3cee343e4106256fd8d11a_coinminer_dosia_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch

.exe 13.7MB

2026-08-03_5b50233f6f3cee343e4106256fd8d11a_coinminer_dosia_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch

SHA256 52efffd581538662bb8b93bc80a4b27fcfa0bb21f08348cf0e960efe6332145d
MD5 5b50233f6f3cee343e4106256fd8d11a
SHA1 e394693c4d80e92fd085c0a7f1559c986b79b905
SHA512 d60c0cc2d327eb0423800ef481bc76c3d0d2451d75fcffb20b211057cc2c5102e6fe552353be0932a6c2b91dc09db9a2dde052c610cfc3b920b14fafcefe3884
SSDEEP 98304:a2MxjftTK0UJY105l3rLemdLvqBQONfoA+ltExP:aB7t4JxrLeGLvqB1yr+xP
TLSH
T179E64B53ECB51198E0AD9575C6239663BBB13C894B3063D31B90F7252F37BD0AABA740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects SkuldStealer
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables containing URLs to raw contents of a Github gist
Detects executables containing possible sandbox system UUIDs
Detects executables referencing virtualization MAC addresses
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths