General
- Target 2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 15.3MB
- Sample260807-w2xesa1fpg
- SHA256 54981838588030121270c471c523ae39b47d0f4528683036721e04681588ddb2
Score
10/10
Malware Config
Targets
-
- Target 2026-08-07_7c202320568ee72972cd795d52b0dcfd_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 15.3MB
- SHA256 54981838588030121270c471c523ae39b47d0f4528683036721e04681588ddb2
Score10/10-
Detects SkuldStealer
-
Family: Skuld stealer
An info stealer written in Go lang.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing possible sandbox system UUIDs
-
Detects executables referencing virtualization MAC addresses
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1