skuld | 69648ee8a1b3da76820725fdffc19c869022a3d3d35d14de48db672399001b4b

General

Target
2026-08-04_acc93650335a84921b7723a86126c894_coinminer_dosia_elex_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch
Size 10.6MB
Sample260804-rye9waztb1
SHA256 69648ee8a1b3da76820725fdffc19c869022a3d3d35d14de48db672399001b4b
MD5 acc93650335a84921b7723a86126c894
SHA1 e34d508fac72033e391de8fc5c23713221d7dbd4
SHA512 7c16ae02d8e38fb07d1df96fefd17f6726824288d6295d5e4d63d5bea79560d81ba9d0690702729a79b79518ce249355ea0c489431192978adc40865990322dd
SSDEEP 98304:0dohmeKppFjIEt9vi085Wn7/fy3hqpEDLKy2zraUE0H:0lpMB5WWh7+y2g0H
TLSH
T102B63841FEAB51F6E5035D725067A26F63381E048B38CBD7EB54BF6AE8376911833206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-04_acc93650335a84921b7723a86126c894_coinminer_dosia_elex_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch
- Size 10.6MB
- SHA256 69648ee8a1b3da76820725fdffc19c869022a3d3d35d14de48db672399001b4b
- MD5 acc93650335a84921b7723a86126c894
- SHA1 e34d508fac72033e391de8fc5c23713221d7dbd4
- SHA512 7c16ae02d8e38fb07d1df96fefd17f6726824288d6295d5e4d63d5bea79560d81ba9d0690702729a79b79518ce249355ea0c489431192978adc40865990322dd
- SSDEEP 98304:0dohmeKppFjIEt9vi085Wn7/fy3hqpEDLKy2zraUE0H:0lpMB5WWh7+y2g0H
- TLSH
  T102B63841FEAB51F6E5035D725067A26F63381E048B38CBD7EB54BF6AE8376911833206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery skuld stealer upx
- Detects SkuldStealer
- Family: Skuld stealer
  An info stealer written in Go lang.
  stealer skuld
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables Discord URL observed in first stage droppers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables containing possible sandbox system UUIDs
- Detects executables referencing virtualization MAC addresses
- UPX dump on OEP (original entry point)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects SkuldStealer

Family: Skuld stealer

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects executables Discord URL observed in first stage droppers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables containing URLs to raw contents of a Github gist

Detects executables containing possible sandbox system UUIDs

Detects executables referencing virtualization MAC addresses

UPX dump on OEP (original entry point)

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2