Extracted

• • Target
    2026-10-26_bd47636b3382e3b96bfe5e4115ee1d25_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_ngrbot_poet-rat_quasar-rat_salatstealer_sliver_snatch
  • Size 10.4MB
  • SHA256 4fe3ad01289999818c94e5046b8439e0ea5dbb67b422ae183b010a8b18b3e999
  • MD5 bd47636b3382e3b96bfe5e4115ee1d25
  • SHA1 14cc9f0c2002239dc755b536c3fd45a2d875c8df
  • SHA512 9b97fe483f30f2c4968d32c1f013c6ed8684e42b6803c1fb16ad4301549c0c146e941cfdf95c69fcaa051fb87cea703dedc9ecc30a4e3c9ba6cc72bd8526ae56
  • SSDEEP 98304:iSpI9esMuEsSil8Stm8YRZAIkGv6hT8mexYEOxBSe+JB5AENz:idE5uEs1l8fk7+6hTTee/kJB55Nz
  • TLSH
    T133B64A47E8A545E5C0A9D175CA669223BF713C884B3063D36F60F7242F76BE0AEB9740
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryskuldpersistencestealer

  • Detects SkuldStealer

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables Discord URL observed in first stage droppers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables referencing virtualization MAC addresses

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2