Extracted

• • Target
    2026-09-05_68d86a80cc3627bc3150d0a0d313b15b_hive
  • Size 4.5MB
  • SHA256 250dbaee468c4c131728b12aa7bc46bd3176f62fcf28d6d2a7461e579a10855d
  • MD5 68d86a80cc3627bc3150d0a0d313b15b
  • SHA1 78df4239f5e2c78e772a1b724dcb126e76ab3f3d
  • SHA512 28427ab9eeda1c408bc7177aea17bdab0c0b5923e29d7bf7f32446a018a15c33e39eb7adf27b4bcf30ad9a8b93802bdd67957e5691fb78daa1cf88f68990b503
  • SSDEEP 98304:HiWyF7pELcMx5A0uMy+lmuDQwPuZHRR60xyJDJIr57Z3FVWVbs:EFVELhxI90vuZ760xgJIr5jVgY
  • TLSH
    T19B263302692E8FD1F48EB07F232B46F64684F1D3D399DC88C6A7859546AE3AC71F504B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryskuldpersistencestealerupx

  • Detects SkuldStealer

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables Discord URL observed in first stage droppers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables referencing virtualization MAC addresses

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2