Windows users: Skuld malware utilizes sophisticated techniques to infiltrate Windows systems and gain unauthorized access to sensitive information. The malware specifically targets web browsers and Discord accounts, aiming to steal data from these sources.

Upon execution, Skuld searches for data stored in folders related to Discord accounts and web browsers, with a particular focus on financial information and cryptocurrency wallets. It also employs techniques to check if it is running in a virtual environment and terminates itself if virtualization is detected.

Once confirmed to be running on a Windows device, Skuld compares running processes against a predefined blocklist that includes username, PC name, HWID, and public IP address. If a match is found, the malware terminates the matched process and exfiltrates data using an actor-controlled Discord webhook. It may also use the Gofile upload service to steal ZIP files through a reference link.

Researchers discovered that Skuld is based on open-source malware projects such as BlackCap Grabber, Creal Stealer, and Luna Grabber, and it is built using the Go programming language (Golang). The malware developer has created accounts on various social media platforms and may offer Skuld for sale to other cybercriminals through a Telegram group called Deathinews.

Skuld’s capabilities include collecting system metadata, harvesting cookies and credentials from web browsers, searching for files in Windows user profile folders, corrupting Discord Token Protector and Better Discord files, injecting JavaScript code into the Discord app to steal backup codes, and utilizing a clipper module to modify clipboard content. It can also swap wallet addresses with attackers to steal cryptocurrency.

Windows users are advised to stay vigilant, keep their systems updated, and implement robust security measures to protect against Skuld and similar malware threats.

Categorized in:

Uncategorized