A new information stealer called Skuld has been discovered, and it is currently targeting Windows systems worldwide. It has been observed compromising systems across Europe, Southeast Asia, and the United States. The malware is designed to steal sensitive information from its victims, including data stored in applications such as Discord and web browsers, as well as information from the system and files stored in the victim’s folders.
Skuld’s information-stealing capabilities
The Skuld malware is the creation of a developer who goes by the online alias “Deathined” on social media platforms. What makes the Skuld malware unique is its ability to steal sensitive information from a wide range of sources, including different types of data in web browsers and applications such as Discord.
Skuld is designed to steal sensitive information from its victims. This includes data stored in web browsers, applications, system files, and documents. Skuld can extract cookies and credentials stored in web browsers and files present in the Windows user profile folders, as well as information stored in the system and in different applications such as Discord.
The Developer behind Skuld
The Skuld malware is developed by a person who goes by the name Deathined. The developer is suspected to be based in Southeast Asia and is known for creating different types of malware that are used for information stealing, including infostealers, keyloggers, and remote access tools.
Methods to steal information
The Skuld malware uses different methods to steal sensitive information from the victim’s computer. Besides gathering system metadata, the malware possesses capabilities to harvest cookies and credentials stored in web browsers, as well as files present in the Windows user profile folders.
Skuld’s Detection and Termination Mechanisms
Skuld is designed to detect and terminate any process that matches those present on the blocklist. The malware checks whether it is running in a virtual environment and extracts the list of running processes, terminating any process that matches those on the blocklist.
Detection of Virtual Environments
Skuld is designed to check if it’s running in a virtual environment. If it detects that it’s running in a virtual environment, it extracts the list of running processes, terminates any process that matches those present in the blocklist, and attempts to evade analysis.
Terminating blocked processes
Skuld is designed to terminate any blocked processes. The malware checks if there are any processes that match those present in the blocklist, and if so, it terminates them.
The Skuld malware is designed to hijack Discord accounts to gain access to sensitive information. The malware corrupts legitimate files associated with Better Discord and Discord Token Protector, and injects JavaScript code into the Discord app to siphon backup codes – mirroring a technique similar to that of another Rust-based info-stealer.
Corrupting Legitimate Files
Skuld is designed to corrupt legitimate files associated with Better Discord and Discord Token Protector. This allows the malware to inject JavaScript code into the Discord app to steal backup codes.
The potential for a Skuld clipper module
The cybersecurity company that discovered Skuld believes that it is likely in development to incorporate a clipper module to alter clipboard content and steal cryptocurrency assets by swapping wallet addresses. This is a new tactic that is becoming increasingly popular with malware developers.
Skuld’s Data Exfiltration Methods
Skuld is designed to exfiltrate data from the victim’s computer. The malware does so by using an actor-controlled Discord webhook or the Gofile upload service.
Discord Webhook
The Skuld malware uses an actor-controlled Discord webhook to exfiltrate data from the victim’s computer. A webhook is a way for a third-party application to communicate with a service like Discord.
Gofile is an upload service
Skuld is designed to use the Gofile upload service to exfiltrate data from the victim’s computer. This service allows the malware to upload files from the victim’s computer to a remote server controlled by the attacker.
The Rise of Go in Malware Development
Golang’s steady adoption among threat actors, due to its simplicity, efficiency and cross-platform compatibility, makes it an attractive vehicle to target multiple operating systems and expand their victim pool.
The Attractiveness of Golang for Malware Development
Golang is considered attractive for malware development activities due to its efficiency, simplicity, and cross-platform compatibility. These features make it easier for malware developers to create binary executables that run on multiple platforms.
Difficulty in Detecting and Mitigating Golang-Based Malware
The compiled nature of Golang makes it difficult for security researchers and traditional anti-malware solutions to effectively detect and mitigate these threats.
The Skuld malware is a new information stealer that has been designed to steal sensitive data from victims’ computers. It uses a variety of techniques to do so, including Discord hijacking, detecting virtual environments, and blocking processes. Skuld’s developers appear to be based in Southeast Asia, and the malware is part of a larger trend of malware written in Golang becoming increasingly common. If malware authors continue to utilize Golang, security professionals must adapt and find new ways to detect and mitigate these threats effectively.