shurk | 9fc9eb14ef8cae1832d29e2b831fef33ad1fdd27de590f1d7727dc58f260992e

Analysis

Target
crypt.exe
Size 903KB
Sample211117-ql932scgc2
SHA256 9fc9eb14ef8cae1832d29e2b831fef33ad1fdd27de590f1d7727dc58f260992e
MD5 2922d5615567df2306d58966388f94c5
SHA1 4d4ee306d47afabb7ceccc9c691b218effaaf3d9
SHA512 a1a03db85af9df0306ddc8d8be10a624b83999cca9a74053ea15bf66a6441fcc63dca4fabe373b9815f3854770d47f08e836540a59cae19ff0531921d11d9b38
MD5 SHA1 SHA512

Score

10^/10

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3700	crypt.exe
3700	crypt.exe

C:\Users\Admin\AppData\Local\Temp\crypt.exe
"C:\Users\Admin\AppData\Local\Temp\crypt.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3700

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact