Overview

overview

10

Static

static

10

payload.bin.exe

windows10_x64

10

Resubmissions

24-08-2021 11:16

210824-cr7ejlmq52 10

24-08-2021 11:10

210824-h5xzl36re6 10

24-08-2021 10:57

210824-r8ta8bdd7n 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payload.bin

  • Size

    472KB

  • Sample

    210824-h5xzl36re6

  • MD5

    a89b5a1a3c1a93488c80c0068fa16109

  • SHA1

    adeb69a80fe2bf50fd4ce269cc061a92b7ea7314

  • SHA256

    6cdefe842611b0f9fea4571bc07ff0de77740f440115852436f4afd1324e981a

  • SHA512

    c9ad3935a82af2c10c7db9e2a5b83e498de7fa8864b81db33798b629aeff72ce8a5b0dcd66ddf595c608bd87e0b9a94f70fef53f58d506095dbdcb4a8416061e

Score
10/10
shurkevasioninfostealerpersistencespywarestealer

Malware Config

Targets

    • Target

      payload.bin

    • Size

      472KB

    • MD5

      a89b5a1a3c1a93488c80c0068fa16109

    • SHA1

      adeb69a80fe2bf50fd4ce269cc061a92b7ea7314

    • SHA256

      6cdefe842611b0f9fea4571bc07ff0de77740f440115852436f4afd1324e981a

    • SHA512

      c9ad3935a82af2c10c7db9e2a5b83e498de7fa8864b81db33798b629aeff72ce8a5b0dcd66ddf595c608bd87e0b9a94f70fef53f58d506095dbdcb4a8416061e

    Score
    10/10
    shurkevasioninfostealerpersistencespywarestealer

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Shurk

      Shurk is an infostealer, written in C++ which appeared in 2021.

      infostealershurk

    • Modifies Installed Components in the registry

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks