Extracted

• • Target
    2026-09-20_ef47acb359288d1616e367c6f134bbd8_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
  • Size 11.1MB
  • SHA256 c735742fda0565008e2ee0610f11d9c00f78e25417a4e977dc07ee02ce012ff0
  • MD5 ef47acb359288d1616e367c6f134bbd8
  • SHA1 13f8d3ce961deb930b5c879a6867a4c3fc05598d
  • SHA512 4ca75f731350c95a7a1d37c079e1e7d467b06127106ccbfe7fbb7dc9ab625aef93b9f3f4fd659aca0a5a49e12fd55244d4abbb12219884c422e24b7b40a88097
  • SSDEEP 98304:oqpiLS8ChiXBrTovJx4am01GNiowZPQIokhlEQhE7eEzr:nKDBrMqsQiogPQIoSryXzr
  • TLSH
    T1CEC65A57ECA915E8C0AEC175C62A92677B713C894F3063D71B50F6242FB2BE0ADB9740
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryskuldpersistencestealer

  • Detects SkuldStealer

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables Discord URL observed in first stage droppers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables referencing virtualization MAC addresses

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1