shurk | 7c9b6c29f32ec5467e04534890e7db40bedaafc1e4d7c07b34de45a331ff93d1

Analysis

Target

7c9b6c29f32ec5467e04534890e7db40bedaafc1e4d7c07b34de45a331ff93d1.exe
Size

501KB
MD5

1de2235cdb15b6a83e87b35e228a8de4
SHA1

f62bc201eaf7fe0aab43b1290a7a27d1ff9ed3a4
SHA256

7c9b6c29f32ec5467e04534890e7db40bedaafc1e4d7c07b34de45a331ff93d1
SHA512

4e90d1e89af0665b01d849ef83016f7ba65e2d4052ddda96a7b7df4c9c19dffc6dd9a5fbfd5eb4d8e3f0fc5a7a774c4f163b3a5b40a06e98d793c6b73ae93b7f

Score

10^/10

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1644	7c9b6c29f32ec5467e04534890e7db40bedaafc1e4d7c07b34de45a331ff93d1.exe

C:\Users\Admin\AppData\Local\Temp\7c9b6c29f32ec5467e04534890e7db40bedaafc1e4d7c07b34de45a331ff93d1.exe
"C:\Users\Admin\AppData\Local\Temp\7c9b6c29f32ec5467e04534890e7db40bedaafc1e4d7c07b34de45a331ff93d1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact