General
- Target 2026-08-05_3f1b452d514f40360c1e379e6adc72bf_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 15.5MB
- Sample260805-hvwysafd69
- SHA256 c03ed5470dcdd41391c80f90c51fa78a95bbe5f970dd8e2334422abcc880c9cd
Score
10/10
Malware Config
Targets
-
- Target 2026-08-05_3f1b452d514f40360c1e379e6adc72bf_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 15.5MB
- SHA256 c03ed5470dcdd41391c80f90c51fa78a95bbe5f970dd8e2334422abcc880c9cd
Score10/10-
Detects SkuldStealer
-
Family: Skuld stealer
An info stealer written in Go lang.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing possible sandbox system UUIDs
-
Detects executables referencing virtualization MAC addresses
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.