General
- Target 2026-08-05_a4baeaf9c376e6c7aaf6ff33f1141db3_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 15.5MB
- Sample260805-gbfxsabj2v
- SHA256 af9adced8db5b973832d2fc0d6986e00f87e1e1c6a2af441c6e079ca8b85a33d
Score
10/10
Malware Config
Targets
-
- Target 2026-08-05_a4baeaf9c376e6c7aaf6ff33f1141db3_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 15.5MB
- SHA256 af9adced8db5b973832d2fc0d6986e00f87e1e1c6a2af441c6e079ca8b85a33d
Score10/10-
Detects SkuldStealer
-
Family: Skuld stealer
An info stealer written in Go lang.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing possible sandbox system UUIDs
-
Detects executables referencing virtualization MAC addresses
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.