斯库尔德 - 凭证窃取器 斯库尔德（Discord/浏览器，Go）

项目说明

<di="center">
<a href=" src=" alt="Forks"></a>
<a href=" src=" alt="Stargazers"></a>
<a href=" src=" alt="Issues"></a>
<a href=" src=" alt="MIT License"></a>
</div>

<br>

<p align="center">
<img src="./.github/assets/avatar.png" width=100 >
</p>

<h1 align="center">Skuld Stealer</h1>

<p align="center">Go-written Malware targeting Windows systems, extracting User Data from Discord, Browsers, Crypto Wallets and more, from every user on every disk. (PoC. For Educational Purposes only)</p>

---

<details>
<summary>Table of Contents</summary>
<ol>
<li>
<a href="#about-the-project">About The Project</a>
<ul>
<li><a href="#features">Features</a></li>
</ul>
</li>
<li>
<a href="#getting-started">Getting Started</a>
<ul>
<li><a href="#prerequisites">Prerequisites</a></li>
<li><a href="#installation">Installation</a></li>
</ul>
</li>
<li><a href="#usage">Usage</a></li>
<li><a href="#preview">Preview</a></li>
<li><a href="#remove">Remove</a></li>
<li><a href="#contributing">Contributing</a></li>
<li><a href="#license">License</a></li>
<li><a href="#contact">Contact</a></li>
<li><a href="#acknowledgments">Acknowledgments</a></li>
<li><a href="#disclaimer">Disclaimer</a></li> </ol>
</details>

About the project

This proof of concept project demonstrates a "Discord-oriented" stealer implemented in Go. The malware operates on Windows systems and use fodhelper.exe technique for pri ele. By ele pri, the malware gains access to all user sessions on every disk

Features:

antidebug: Terminates debugging tools.

antivirus: Disables Windows Defender and blocks access to antivirus websites.

anti and exits when running in machines (VMs).

browsers:

- Steals logins, cookies, credit cards, history, and download lists from 37 Chromium-based browsers.
- Steals logins, cookies, history, and download lists from 10 Gecko browsers.

clipper: Replaces the user's clipboard content with a specified crypto address when copying another address.

commonfiles: Steals sensiti from common locations.

discodes: Captures Discord Two-Factor Authentication (2FA) backup codes.

discordinjection:

- Intercepts login, register, and 2FA login requests.
- Captures backup codes requests.
- Monitors email/password change requests.
- Intercepts credit card/PayPal addition requests.
- Blocks the use of QR codes for login.
- Prevents requests to view devices.

fakerror: Trick user into believing the program closed due to an error.

games: Extracts Epic Games, Uplay, Minecraft (14 launchers) and Riot Games sessions.

hideconsole: Module to hide the console.

startup: Ensures the program runs at system startup.

system: Gathers CPU, GPU, RAM, IP, location, sa networks, and more.

tokens: Extracts tokens from 4 Discord applications, Chromium-based browsers, and Gecko browsers.

uacbypass: Grants pri to steal user data from others users.

wallets: Steals data from 10 local wallets and 55 钱包 extensions.

walletsinjection: Captures mnemonic phrases and passwords from 2 crypto wallets.

Getting started

Prerequisites

* Git
* The Go Programming Language

Installation

To install this project using Git, follow these steps:

Clone the Repository:

Na to the Project Directory:

Usage

You can use the Project template:

Open main.go and edit config with your Discord webhook and your crypto addresses

Build the template: (reduce binary size by using -s -w)

You can hide the console without hideconsole module (you must remove program.IsAlreadyRunning() check from main.go before) by running

You can also optionally pack the output executable with UPX which will reduce the binary size from ~10MB to ~3MB. To do this, install UPX and run

You can also use skuld in your own Go 代码. Just import the desired module like this:

Preview








Remove

This guide will help you removing skuld from your system

1. Open powershell as administrator

2. Kill processes that could be skuld

(use tasklist to list all running processes, skuld.exe and SecurityHealthSystray.exe are the default names)

3. Remo from startup

(Realtek HD Audio Uni Service is the default name)

4. Enable Windows defender:

You can do it by running this .bat script (I'm not the de behind it, make sure the file does not contain malware)

Contributing

Contributions to this project are welcome! Feel free to open issues, submit pull requests, or suggest impro. Make sure to follow the Contributing Guidelines

You can also support this project de by leaving a star ⭐ or by donating me. Every little tip helps!

<a href=' src='.github/assets/kofi.png' width=150></a>

License

This library is released under the MIT License. See LICENSE file for more informations.

Contact

If you have any questions or need further assistance, please contact :matrix.org

Acknowledgments

This project has been greatly influenced by numerous infostealers a on GitHub. Many functions and sensiti have been derived from public repositories. My objective was to innovate by creating something new with 代码 from existing projects. I extend my gratitude to all those whose work has contributed to this stealer, especially

FallenAstaroth for tempfile-less browsers data extraction

ᴍᴏᴏɴD4ʀᴋ for browsers data decryption

addi00000 for Discord embeds design

Blank-c for anti functions and more

6nz for anti

Disclaimer

Important Notice: This 工具 is intended for educational purposes only.

This software, referred to as skuld, is provided strictly for educational and research purposes. Under no circumstances should this 工具 be used for any malicious acti, including but not limited to unauthorized access, data theft, or any other harmful actions.

Usage Responsibility:

By accessing and using this 工具, you acknowledge that you are solely responsible for your actions. Any misuse of this software is strictly prohibited, and the creator (hackirby) disclaims any responsibility for how this 工具 is utilized. You are fully accountable for ensuring that your usage complies with all applicable laws and regulations in your jurisdiction.

No Liability:

The creator (hackirby) of this 工具 shall not be held responsible for any damages or legal consequences resulting from the use or misuse of this software. This includes, but is not limited to, direct, indirect, incidental, consequential, or puniti arising out of your access, use, or inability to use the 工具.

No Support:

The creator (hackirby) will not provide any support, guidance, or assistance related to the misuse of this 工具. Any inquiries regarding malicious acti will be ignored.

Acceptance of Terms:

By using this 工具, you signify your acceptance of this disclaimer. If you do not agree with the terms stated in this disclaimer, do not use the software.

技术栈

开发语言：未知

项目类型：凭证窃取器 Skuld（Discord/浏览器，Go）

Star 数：0

功能特点

这是一套凭证窃取器 Skuld（Discord/浏览器，Go），代码结构清晰，适合安全研究人员学习加密货币钱包安全、剪贴板劫持、私钥碰撞等攻击面的原理与实现。项目涵盖了地址生成、私钥管理、链上交互、剪贴板监控等核心模块，对理解区块链资产安全机制具有较高的研究价值。

从技术实现角度看，此类项目的技术点在于：私钥熵源与生成算法、链上余额查询接口、剪贴板监听与地址替换逻辑、以及多链钱包地址的编码差异。本项目在这些方面提供了可运行的实现，研究者可以在此基础上进行安全分析或防御研究。

使用说明

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境（Python / Node.js / Go / C# 等）。

3. 按照 README 中的步骤安装依赖、配置环境变量。

4. 运行脚本或编译程序，观察输出结果。

注意：本项目仅供安全研究与学习使用，请勿用于任何非法用途。

研究价值

对于从事区块链安全、渗透测试或恶意样本分析的研究者来说，这套源码是一个很好的研究对象。通过阅读代码，可以学习到加密货币钱包的攻击面、剪贴板劫持的检测方法、私钥碰撞的概率原理、以及链上资产的追踪技术等关键知识点。

同时，项目中的代码组织和模块划分，也展示了安全工具在工程化方面的实践经验。理解这些攻击工具的实现原理，对后续开发防御检测工具、建立资产风控模型也很有帮助。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。若涉及第三方权益，请联系删除。