shurk | fab8a31dbd77da2d6f0e1be73b008ee07bcd7f20a2b9ff3de8fc8642088ed7ee

Sharing

Copy URL Twitter E-mail

General

Target
fab8a31dbd77da2d6f0e1be73b008ee07bcd7f20a2b9ff3de8fc8642088ed7ee
Size 493KB
Sample220420-dfb8lsefbl
SHA256 fab8a31dbd77da2d6f0e1be73b008ee07bcd7f20a2b9ff3de8fc8642088ed7ee
MD5 cd135eebb454cada149a3892e6a346ec
SHA1 830766cf41d9032ecf4a3c735d1b7f24855e2a4a
SHA512 7133c14ed3895c45c73e526586d75b4e586e500557b5e3f172c23bb86634521eb5aa9615cd0e6e02f850698034ebbf847ac9114930134e129753adb59713940d
SSDEEP 12288:2BG/I7FGGnI0+uJ6BB0GzEHXOc0BYkgqDUOcU/B99gwueugzJGrlG/4upuT:2UiFHI0+A6BB0AEHXOcADgqlcU/ja+4/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

shurk

Malware Config

Signatures

Shurk Stealer Payload 1 IoCs

resource	yara_rule
sample	shurk_stealer

Shurk family
shurk

File Explorer

fab8a31dbd77da2d6f0e1be73b008ee07bcd7f20a2b9ff3de8fc8642088ed7ee

.exe 493KB

fab8a31dbd77da2d6f0e1be73b008ee07bcd7f20a2b9ff3de8fc8642088ed7ee

IMPHASH 44d7fee209dba9201d1a01671048f530
SHA256 fab8a31dbd77da2d6f0e1be73b008ee07bcd7f20a2b9ff3de8fc8642088ed7ee
MD5 cd135eebb454cada149a3892e6a346ec
SHA1 830766cf41d9032ecf4a3c735d1b7f24855e2a4a
SHA512 7133c14ed3895c45c73e526586d75b4e586e500557b5e3f172c23bb86634521eb5aa9615cd0e6e02f850698034ebbf847ac9114930134e129753adb59713940d
SSDEEP 12288:2BG/I7FGGnI0+uJ6BB0GzEHXOc0BYkgqDUOcU/B99gwueugzJGrlG/4upuT:2UiFHI0+A6BB0AEHXOcADgqlcU/ja+4/
MD5 SHA1 SHA512 SSDEEP

windows x86

Shurk Stealer Payload

Minor OS version

Major OS version

Entry point

308329

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesW GetCurrentThreadId MultiByteToWideChar Sleep GetTempPathA GetLastError GetFileAttributesA CreateFileA LoadLibraryA GetVersionExA DeleteFileA DeleteFileW CloseHandle LoadLibraryW UnlockFile GetProcAddress LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers GetModuleFileNameA SizeofResource SetWaitableTimer TlsSetValue VerifyVersionInfoA HeapFree SetLastError VirtualAlloc WaitForMultipleObjects InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus InitializeCriticalSectionEx WaitForSingleObject CreateFileW GetModuleHandleA OpenProcess HeapSize PostQueuedCompletionStatus CreateToolhelp32Snapshot CreateEventW GetFileInformationByHandle CopyFileA QueryFullProcessImageNameA SetEvent FileTimeToSystemTime TerminateThread TlsAlloc LockResource Process32Next HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc QueueUserAPC GetLocalTime DecodePointer HeapDestroy CreateFileMappingA LocalFree VerSetConditionMask GetProcessHeap SystemTimeToFileTime SleepEx TlsGetValue TlsFree MapViewOfFile CreateIoCompletionPort GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP GetTempPathW SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LeaveCriticalSection WriteFile LockFile GetFullPathNameW EnterCriticalSection ReadFile UnmapViewOfFile AreFileApisANSI IsValidCodePage WriteConsoleW ReadConsoleW GetTimeZoneInformation GetFileSizeEx GetConsoleMode GetConsoleCP LCMapStringW CompareStringW GetFileType GetCPInfo GetCommandLineW GetCommandLineA GetStdHandle GetModuleFileNameW FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess VirtualQuery VirtualProtect GetSystemInfo LoadLibraryExW EncodePointer RtlUnwind ResetEvent WaitForSingleObjectEx GetModuleHandleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead GetCurrentProcess TerminateProcess FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW RemoveDirectoryW SetFilePointerEx FormatMessageW SwitchToThread OutputDebugStringW

user32

GetSystemMetrics GetDesktopWindow ReleaseDC GetDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject GetObjectA BitBlt

advapi32

RegGetValueA RegOpenKeyExA

crypt32

CryptUnprotectData

bcrypt

BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptSetProperty

shlwapi

PathFindExtensionA PathFindExtensionW

gdiplus

GdipSaveImageToFile GdipCreateBitmapFromScan0 GdipGetImageEncodersSize GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdiplusShutdown GdiplusStartup

ws2_32

connect getsockopt htonl WSAStartup ioctlsocket setsockopt WSAGetLastError WSACleanup WSASocketW WSAStringToAddressW WSASetLastError ntohl select closesocket WSASend htons