skuld | 9b1568b70349b8f5853c0d468b282a4c92d7c6e5171346e9fc55811b31148e5b

General

Target
2026-11-08_cdaa46992c144eae01329ce11797428e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 16.2MB
Sample261108-yaglcsah67
SHA256 9b1568b70349b8f5853c0d468b282a4c92d7c6e5171346e9fc55811b31148e5b
MD5 cdaa46992c144eae01329ce11797428e
SHA1 56d2f9c3b99ff2c05ddb5a19bee79c63a9cff76d
SHA512 3e134ee843c8fb30ebeb484b02de77e68db4b6d4b4b02ff5f0888bb0ea94225c0faa356b07472b1a7bc6dd36c9d8c01f619b44bd43143692371c610b7229b103
SSDEEP 196608:f48KpHSpYXhTuYF3bTpQRHsTRBDy9aXLQ:fRO5XpuLHsTn
TLSH
T1D7076A47EC6905E4C0AED971CA6692137B717C895B3023DB2B50FA242F73BD0AEB9744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-08_cdaa46992c144eae01329ce11797428e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 16.2MB
- SHA256 9b1568b70349b8f5853c0d468b282a4c92d7c6e5171346e9fc55811b31148e5b
- MD5 cdaa46992c144eae01329ce11797428e
- SHA1 56d2f9c3b99ff2c05ddb5a19bee79c63a9cff76d
- SHA512 3e134ee843c8fb30ebeb484b02de77e68db4b6d4b4b02ff5f0888bb0ea94225c0faa356b07472b1a7bc6dd36c9d8c01f619b44bd43143692371c610b7229b103
- SSDEEP 196608:f48KpHSpYXhTuYF3bTpQRHsTRBDy9aXLQ:fRO5XpuLHsTn
- TLSH
  T1D7076A47EC6905E4C0AED971CA6692137B717C895B3023DB2B50FA242F73BD0AEB9744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution skuld persistence privilege_escalation spyware stealer trojan
- Detects SkuldStealer
- Family: Skuld stealer
  An info stealer written in Go lang.
  stealer skuld
- Custom signature
  
  Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables containing URLs to raw contents of a Github gist
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1