shurk | d53833260355341daa8c6df2aea9857d

General

Target
d53833260355341daa8c6df2aea9857d
Size 3.9MB
Sample220427-kveevaddhj
SHA256 0b475cf8bae51ab390c0b040e7a77c925b8aeca39753367c9d3b2e149ee59ef2
MD5 d53833260355341daa8c6df2aea9857d
SHA1 ce5c2ea499f08fc5b8a2c97ac1bada74645bc7a1
SHA512 d068bb47c1097b8e45567fea47c2351fbfe542d1cef8e99f6da1f0abfe3abe3e8bcc8fbb40d1b41c51aeb0204af2e779d9ee8857cfe9adbbd2063aac359699e4
SSDEEP 98304:Rf2SCMKN+UbwXN9M1W7bkQ9vkr1X3QIPrME:529MKNIXMqM1TPr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx shurk

Malware Config

Signatures

Shurk Stealer Payload 1 IoCs

resource	yara_rule
static1/unpack001/out.upx	shurk_stealer

Shurk family
shurk

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

d53833260355341daa8c6df2aea9857d

.exe 3.9MB
out.upx

.exe 10.7MB

d53833260355341daa8c6df2aea9857d

SHA256 0b475cf8bae51ab390c0b040e7a77c925b8aeca39753367c9d3b2e149ee59ef2
MD5 d53833260355341daa8c6df2aea9857d
SHA1 ce5c2ea499f08fc5b8a2c97ac1bada74645bc7a1
SHA512 d068bb47c1097b8e45567fea47c2351fbfe542d1cef8e99f6da1f0abfe3abe3e8bcc8fbb40d1b41c51aeb0204af2e779d9ee8857cfe9adbbd2063aac359699e4
SSDEEP 98304:Rf2SCMKN+UbwXN9M1W7bkQ9vkr1X3QIPrME:529MKNIXMqM1TPr
MD5 SHA1 SHA512 SSDEEP

windows x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

11649184

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 a88ab24af7f9e86b86b426d0d1c549ee3bad4446889b50550036e08d87d090fc
MD5 35fbb9c0de5e2c04a36b258566fc9efd
SHA1 40fce2ee0a8e1b6b63378d142cfbcde328581f1d
SHA512 dfa7f271116e28f610fb502e9ec18e6ecf165b27fe8859216cf9281b37825e74ea1e4c61a242168565c0f3f8c521a5527f9a9ad13ed70d81e962641fa98a3268
SSDEEP 98304:rki3ObswsKd3WPrqnHRWrXRiE0qzTco9Ky3/qtjws8of7xrf:g79sK8rqnHMr5NBims8ozx
MD5 SHA1 SHA512 SSDEEP

windows x64

Shurk Stealer Payload
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

366496

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.6MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d53833260355341daa8c6df2aea9857d

out.upx