skuld | a42dd814324a8aecd176702230e8c355dc06e18934df019e8fee2a8a8772d65a

General

Target
2026-09-20_f66f4f547cf01ffd0610ee020721fd2a_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
Size 11.0MB
Sample260920-19acfa1v8j
SHA256 a42dd814324a8aecd176702230e8c355dc06e18934df019e8fee2a8a8772d65a
MD5 f66f4f547cf01ffd0610ee020721fd2a
SHA1 70f66fd03907103b882cae007c9ac1c53903a082
SHA512 2230e7b8d8c9704cadb8180fec87a12e06dc6a42f5d47fbd650cc4d477e260728b951a9a3af5172f02b22df2b57e67e93136a044675e469a53260a05acf4e895
SSDEEP 98304:+jnNvjKaXwL8ufTIwCirS70vQ9bHX6CaYWFOWE4j:olFwxZbrSIvQ9bvhkOT4j
TLSH
T112C65A43ECA505E5C0AED176C6269123BB713C885B3463D72B90F6246F73BE0AEB9744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-20_f66f4f547cf01ffd0610ee020721fd2a_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 11.0MB
- SHA256 a42dd814324a8aecd176702230e8c355dc06e18934df019e8fee2a8a8772d65a
- MD5 f66f4f547cf01ffd0610ee020721fd2a
- SHA1 70f66fd03907103b882cae007c9ac1c53903a082
- SHA512 2230e7b8d8c9704cadb8180fec87a12e06dc6a42f5d47fbd650cc4d477e260728b951a9a3af5172f02b22df2b57e67e93136a044675e469a53260a05acf4e895
- SSDEEP 98304:+jnNvjKaXwL8ufTIwCirS70vQ9bHX6CaYWFOWE4j:olFwxZbrSIvQ9bvhkOT4j
- TLSH
  T112C65A43ECA505E5C0AED176C6269123BB713C885B3463D72B90F6246F73BE0AEB9744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution skuld persistence privilege_escalation spyware stealer trojan
- Detects SkuldStealer
- Family: Skuld stealer
  An info stealer written in Go lang.
  stealer skuld
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables Discord URL observed in first stage droppers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables containing possible sandbox system UUIDs
- Detects executables referencing virtualization MAC addresses
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1