skuld | 2de562fafcc37cae182d78ac490f01f38f78f57b845dd7b34641733d616bd0f8

General

Target
skuld.exe
Size 15.3MB
Sample260806-nkfrpstyg1
SHA256 2de562fafcc37cae182d78ac490f01f38f78f57b845dd7b34641733d616bd0f8
MD5 12ac840782156d93a3d9d2f88b284205
SHA1 9d2612a0c94835711e8be7548903c9aa99b508ff
SHA512 63ae8e52d4fddcd12d7ba5da6977dbd2ffa0227f832c799c2097237e9780b5e08a553024b9c029a353a7172d0dc2e3f3e37ec250f35220539e0ffd1241f3f543
SSDEEP 196608:4csRmsp23tB2UvPzwXkltTghuX4hTEceyNDBo/z43qPs4t7Me:4tjpM0GhghFT5eyNFo/wCt7Me
TLSH
T133F69D83EC7546D9C0AD927AC6669653BB743C884B3163D32B60B6386F33BD0AE75740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  skuld.exe
- Size 15.3MB
- SHA256 2de562fafcc37cae182d78ac490f01f38f78f57b845dd7b34641733d616bd0f8
- MD5 12ac840782156d93a3d9d2f88b284205
- SHA1 9d2612a0c94835711e8be7548903c9aa99b508ff
- SHA512 63ae8e52d4fddcd12d7ba5da6977dbd2ffa0227f832c799c2097237e9780b5e08a553024b9c029a353a7172d0dc2e3f3e37ec250f35220539e0ffd1241f3f543
- SSDEEP 196608:4csRmsp23tB2UvPzwXkltTghuX4hTEceyNDBo/z43qPs4t7Me:4tjpM0GhghFT5eyNFo/wCt7Me
- TLSH
  T133F69D83EC7546D9C0AD927AC6669653BB743C884B3163D32B60B6386F33BD0AE75740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution skuld persistence privilege_escalation spyware stealer trojan
- Detects SkuldStealer
- Family: Skuld stealer
  An info stealer written in Go lang.
  stealer skuld
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2