Extracted

• • Target
    2026-09-24_0a8581b24c0190a0a99635f1f5483ef1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
  • Size 10.5MB
  • SHA256 d1011391dbabc976c53202c214f129b53f7f07c8aef24ac0106131a88ba203d0
  • MD5 0a8581b24c0190a0a99635f1f5483ef1
  • SHA1 f3b0a7fbb725b85fb5e3b1bcafdb19c277057e6d
  • SHA512 b5c8de254be5704fff8f23ffad443431bb1759e76c598b505155f0cf179a3b3dba6697f90dfc0dd20665250439d52d9a18752b8bbe6ba1294819e2b6fccece02
  • SSDEEP 98304:DOMCDU6z0z7Zi0sf7pEUCQK8aKj5vV01tJTsJkfZ4/4IE3UzoE:DWLw8bK8aM5vV0f+uh4/4IE3UzB
  • TLSH
    T119B63957ECA551E8C0AED175CA269623BB717C884B3063D36B60F6252F37BD0ADB9700
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryskuldpersistencestealer

  • Detects SkuldStealer

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables Discord URL observed in first stage droppers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables referencing virtualization MAC addresses

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2