skuld | ccf1c638a10f5911c17503d537cc3a4ca5f8056585a366748bf4162703254b48

General

Target
2026-11-05_20429b73095af1a6d5d41bc143d95781_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
Size 11.7MB
Sample261107-jdk1maby2j
SHA256 ccf1c638a10f5911c17503d537cc3a4ca5f8056585a366748bf4162703254b48
MD5 20429b73095af1a6d5d41bc143d95781
SHA1 d191404f43a55ca8cfac1be5e8913a631606fd25
SHA512 776f6399440f61051e95af9fec1e071ace39bb3d429444b335994b3ff6aa73633a7bd4f94fa71332537a45e9880b0a242a8d18d8037ad27decb96321e762ba5f
SSDEEP 98304:E1CJJvdXbyKhhfY0eEB/MSc5l32DxjoXKwNMZsS3GtEdTt:VdL5f7GgcX1qf3G+dTt
TLSH
T13FC63843ECA515D5C0AEC576CA369623BB713C884B3063D35B90B6246F77BE0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1560618269818232892/yexvZh-q4T_Xs-ADcWzHORQBPNFWcq6D6Co1II1mxYn_vdkFeP8nruykevdPt3x968_8

Targets

- Target
  2026-11-05_20429b73095af1a6d5d41bc143d95781_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch
- Size 11.7MB
- SHA256 ccf1c638a10f5911c17503d537cc3a4ca5f8056585a366748bf4162703254b48
- MD5 20429b73095af1a6d5d41bc143d95781
- SHA1 d191404f43a55ca8cfac1be5e8913a631606fd25
- SHA512 776f6399440f61051e95af9fec1e071ace39bb3d429444b335994b3ff6aa73633a7bd4f94fa71332537a45e9880b0a242a8d18d8037ad27decb96321e762ba5f
- SSDEEP 98304:E1CJJvdXbyKhhfY0eEB/MSc5l32DxjoXKwNMZsS3GtEdTt:VdL5f7GgcX1qf3G+dTt
- TLSH
  T13FC63843ECA515D5C0AEC576CA369623BB713C884B3063D35B90B6246F77BE0AEB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery skuld persistence stealer
- Detects SkuldStealer
- Family: Skuld stealer
  An info stealer written in Go lang.
  stealer skuld
- Custom signature
  
  Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables Discord URL observed in first stage droppers
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables containing possible sandbox system UUIDs
- Custom signature
  
  Detects executables referencing virtualization MAC addresses
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1