Extracted

• • Target
    2026-10-26_99fca5cfee3b50e69ad5977f1416c4ef_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
  • Size 11.1MB
  • SHA256 06b24fa7a4ae151894e0b9ef2758bdb93b1edc706d633080d8f1554f5bef7c4b
  • MD5 99fca5cfee3b50e69ad5977f1416c4ef
  • SHA1 6f2478325212f9d6117c051dc082a0122659c978
  • SHA512 074ed0aa087c5ff36dfa2c4f2f53c79a1045284a931326559ec6ae3cbee67f2cf1a909ec4616b3c7d6878a4881ad4a052b8b3da1b368e1b663aaee533398ed92
  • SSDEEP 98304:QCFjYP7ctsovi9OANidAgCfhKuQX+2Ol/gEhrUgaHkETrKp:/8QqoA+HCfQuQX+PTgdTrKp
  • TLSH
    T11CC64A57ECA515E5C0AED179C6669113BF713C888B3163D36B50F6242F32BE0AEBA740
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryskuldpersistencestealer

  • Detects SkuldStealer

  • Family: Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables Discord URL observed in first stage droppers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing URLs to raw contents of a Github gist

  • Detects executables containing possible sandbox system UUIDs

  • Detects executables referencing virtualization MAC addresses

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1