General
- Target 2026-08-05_a0c62c7b10e480a9710e294701937e67_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 10.6MB
- Sample260805-hmflts1cpf
- SHA256 6f34d2cf655f2e5b49a6de0e9cba16bfa647e65a7975cbffaffc342ba83ce1e3
Score
10/10
Malware Config
Targets
-
- Target 2026-08-05_a0c62c7b10e480a9710e294701937e67_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 10.6MB
- SHA256 6f34d2cf655f2e5b49a6de0e9cba16bfa647e65a7975cbffaffc342ba83ce1e3
Score10/10-
Detects SkuldStealer
-
Family: Skuld stealer
An info stealer written in Go lang.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing possible sandbox system UUIDs
-
Detects executables referencing virtualization MAC addresses
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.