Analysis
-
max time kernel
110s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
17-11-2021 13:08
General
-
Target
crypt.exe
-
Size
903KB
-
MD5
2922d5615567df2306d58966388f94c5
-
SHA1
4d4ee306d47afabb7ceccc9c691b218effaaf3d9
-
SHA256
9fc9eb14ef8cae1832d29e2b831fef33ad1fdd27de590f1d7727dc58f260992e
-
SHA512
a1a03db85af9df0306ddc8d8be10a624b83999cca9a74053ea15bf66a6441fcc63dca4fabe373b9815f3854770d47f08e836540a59cae19ff0531921d11d9b38
Score
10/10
Malware Config
Signatures
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
suricata: ET MALWARE Win32/HunterStealer/AlfonsoStealer/PhoenixStealer CnC Exfil
suricata: ET MALWARE Win32/HunterStealer/AlfonsoStealer/PhoenixStealer CnC Exfil
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\crypt.exe"C:\Users\Admin\AppData\Local\Temp\crypt.exe"1⤵
- Suspicious behavior: EnumeratesProcesses