skuld | 2026-08-14_c10d55fb1a6a3c1899a14e99a6aff9fb_coinminer_dosia_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_c10d55fb1a6a3c1899a14e99a6aff9fb_coinminer_dosia_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch
Size 13.7MB
Sample260814-hh2cqsxtay
SHA256 4970f9d9717e2844705720806afb3f230ff46c2e7fc58de5c2403acd36fc4ed2
MD5 c10d55fb1a6a3c1899a14e99a6aff9fb
SHA1 4437e5a5f83e23ac37b463e178fe00e1972786d2
SHA512 78667fef80b93dd980c316e6d44c5f6e416da7013958056ce779ba64bf7bf24697716a780ab51cdf2a19af249ee22f328f2f75fcee8b8c8a2e0d388d2d4e84c3
SSDEEP 98304:k5746pNU5DGTh0CQGYrDPSdsvWj0ffoxrzES/1:kewAPzrDPKsvWj0oWS/1
TLSH
T1D9E65B47E8B57198C4AD9135CA36A523BB713C894FB063D32B50F6242F37BD8AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx stealer skuld

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1535982964499021885/8CAq6wP5jByJ1ChLvVx1AguazVp4VfudlD0g0fyXv8QWCQ787xOYwYAhpvOs0orCE17L

Signatures

Family: Skuld stealer
An info stealer written in Go lang.
stealer skuld

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects SkuldStealer 1 IoCs

resource	yara_rule
sample	family_skuld

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_c10d55fb1a6a3c1899a14e99a6aff9fb_coinminer_dosia_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch

File Explorer

2026-08-14_c10d55fb1a6a3c1899a14e99a6aff9fb_coinminer_dosia_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch

.exe 13.7MB

2026-08-14_c10d55fb1a6a3c1899a14e99a6aff9fb_coinminer_dosia_glassworm_hive_ngrbot_poet-rat_quasar-rat_snatch

SHA256 4970f9d9717e2844705720806afb3f230ff46c2e7fc58de5c2403acd36fc4ed2
MD5 c10d55fb1a6a3c1899a14e99a6aff9fb
SHA1 4437e5a5f83e23ac37b463e178fe00e1972786d2
SHA512 78667fef80b93dd980c316e6d44c5f6e416da7013958056ce779ba64bf7bf24697716a780ab51cdf2a19af249ee22f328f2f75fcee8b8c8a2e0d388d2d4e84c3
SSDEEP 98304:k5746pNU5DGTh0CQGYrDPSdsvWj0ffoxrzES/1:kewAPzrDPKsvWj0oWS/1
TLSH
T1D9E65B47E8B57198C4AD9135CA36A523BB713C894FB063D32B50F6242F37BD8AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects SkuldStealer
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables containing URLs to raw contents of a Github gist
Detects executables containing possible sandbox system UUIDs
Detects executables referencing virtualization MAC addresses
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths