Extracted

• • Target
    2026-09-12_5de8db030a31ce0f1bd96c952d5591e5_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
  • Size 10.6MB
  • SHA256 fb7f4176e386cf746e9eef063a479851403ee02124a4fafdd1d528a2db83b21e
  • MD5 5de8db030a31ce0f1bd96c952d5591e5
  • SHA1 9dd58242acd9fdcde64dbd59c0fe0fbc43ba3cfd
  • SHA512 13cf23dad83e1b274b824040a2b1fbc76d1fd9c5f94a6d07bfb897bc6667530ef41f12063f330a99b38df02cb00d8ebcfe29878e3268fcafb5342b63e2b0ff9c
  • SSDEEP 98304:2xAfkJuOYWbKVkoZ6tnr1zGcrvzXkfoNN+UnPEnQb:2keuCtr1zbrvzXbeUMQb
  • TLSH
    T1B6B63957ECB541E8C1AE9175CA369622BF713C884B3463D76B50F6252F32BD0AEB9340
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryskuldpersistencestealer

  • Detects SkuldStealer

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables referencing virtualization MAC addresses

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2