Extracted

• • Target
    2026-08-06_12d8d71c1ac6aec4a18885145bc9c380_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
  • Size 10.6MB
  • SHA256 fbb320f19de9849a4bc63e383cf4300640c205706973751668ab6bcd94f2e0e5
  • MD5 12d8d71c1ac6aec4a18885145bc9c380
  • SHA1 160bc16f84fd2bd2607af334921c50e67c74817c
  • SHA512 df50d35dc034ce32032d1fbdbd0498a4cc3a1b7b02dc0876a05288dbd2cd039b464b97a1967d800369fd4670aa8e24b32df86fca0cd2c4ab85c06589fc280da7
  • SSDEEP 98304:vrev1yhZ/DFeaUsFcfIb9VQdUvKTZrffoSbaEHHb:vQE1mgb9VAUvKTZroynb
  • TLSH
    T1FBB64A57E8B551D8C0AE9175CA269623BB713C884F3063D76B90F6242F37BD0AEB9740
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryskuldpersistencestealer

  • Detects SkuldStealer

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables referencing virtualization MAC addresses

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2