shurk | bf74098547cd28f6682b0448c3656d9ed1da2ec7269f6b95d14aaa7e718f9234

Analysis

Target

bf74098547cd28f6682b0448c3656d9ed1da2ec7269f6b95d14aaa7e718f9234.exe
Size

502KB
MD5

102fbb5525d09f7241e06669dcdb6e17
SHA1

028a3eb20accc4bc1c8a24594a7ed7ef75f71824
SHA256

bf74098547cd28f6682b0448c3656d9ed1da2ec7269f6b95d14aaa7e718f9234
SHA512

1c5cb47ebc91297bd6082c0047b2b049b0161a9f79587189f536b99ae90fa888d8aa26eef5b9dd15623cebd5321996f7100b23c6184346b7004ca75ba74f0d79

Score

10^/10

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	bf74098547cd28f6682b0448c3656d9ed1da2ec7269f6b95d14aaa7e718f9234.exe
5004	bf74098547cd28f6682b0448c3656d9ed1da2ec7269f6b95d14aaa7e718f9234.exe

C:\Users\Admin\AppData\Local\Temp\bf74098547cd28f6682b0448c3656d9ed1da2ec7269f6b95d14aaa7e718f9234.exe
"C:\Users\Admin\AppData\Local\Temp\bf74098547cd28f6682b0448c3656d9ed1da2ec7269f6b95d14aaa7e718f9234.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5004

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact