shurk | ab70b0bfba88d15586fbaee6361842aafeade606deffd38637feb2edb2365be8

Analysis

Target

ab70b0bfba88d15586fbaee6361842aafeade606deffd38637feb2edb2365be8.exe
Size

572KB
MD5

78ae1e832aa0e0c1f2693a28bdd473c0
SHA1

be9a32e8475e31b4ef8aac8c2629d4cee3cb2cf4
SHA256

ab70b0bfba88d15586fbaee6361842aafeade606deffd38637feb2edb2365be8
SHA512

a65d30f5de6944b4f7ecf9b90a089b82f58fb77cfa06b34dab19eb12439ac3b67e17b3637fece6d7771dac68952b23ec441450199eac18bacfee59280a438a48

Score

10^/10

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1404	ab70b0bfba88d15586fbaee6361842aafeade606deffd38637feb2edb2365be8.exe

C:\Users\Admin\AppData\Local\Temp\ab70b0bfba88d15586fbaee6361842aafeade606deffd38637feb2edb2365be8.exe
"C:\Users\Admin\AppData\Local\Temp\ab70b0bfba88d15586fbaee6361842aafeade606deffd38637feb2edb2365be8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1404

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact