skuld | 980641cee92739eb6a004e78e23c3588e67909ad7b0c5853834420114001083c

General

Target
2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
Size 10.4MB
Sample260826-rnkfvaxybx
SHA256 980641cee92739eb6a004e78e23c3588e67909ad7b0c5853834420114001083c
MD5 a81afaa0e83589ca06d7701d80ba3570
SHA1 45bb5e596f9b7e9475d2e68a4cd270d66c3b937b
SHA512 f0ca7c45d044bcd96bbadfd873513bc2182e210fa8502c4e73ac38871a9b4fa51dc559ae30d83d3acc640cbf59f78dbe0beee06f52492d30c90d5c75a62f424d
SSDEEP 98304:2L1bX4rCrSvGBZ6WCNZA0e1vt9EGWWksseWE1/:2FIrJNZAL1v7EGWczT1/
TLSH
T132B64A47E97555E5C0AE9179C6369622BB713C884F3063D32B60FA252F77BD0AEB8340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-25_a81afaa0e83589ca06d7701d80ba3570_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 10.4MB
- SHA256 980641cee92739eb6a004e78e23c3588e67909ad7b0c5853834420114001083c
- MD5 a81afaa0e83589ca06d7701d80ba3570
- SHA1 45bb5e596f9b7e9475d2e68a4cd270d66c3b937b
- SHA512 f0ca7c45d044bcd96bbadfd873513bc2182e210fa8502c4e73ac38871a9b4fa51dc559ae30d83d3acc640cbf59f78dbe0beee06f52492d30c90d5c75a62f424d
- SSDEEP 98304:2L1bX4rCrSvGBZ6WCNZA0e1vt9EGWWksseWE1/:2FIrJNZAL1v7EGWczT1/
- TLSH
  T132B64A47E97555E5C0AE9179C6369622BB713C884F3063D32B60FA252F77BD0AEB8340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution skuld persistence stealer trojan privilege_escalation
- Detects SkuldStealer
- Family: Skuld stealer
  An info stealer written in Go lang.
  stealer skuld
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables Discord URL observed in first stage droppers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables containing possible sandbox system UUIDs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing virtualization MAC addresses
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2