shurk | 92175f70c2e1472fcb742e9dc4939a48da8ae6f02d0177a2387be4235b0b1b23

Analysis

Target

92175f70c2e1472fcb742e9dc4939a48da8ae6f02d0177a2387be4235b0b1b23.exe
Size

502KB
MD5

7f053ba33d6e4bf07a15ee65dd2b0d92
SHA1

84932e276755636d3cafdd44f6e5ba1c5ec53da8
SHA256

92175f70c2e1472fcb742e9dc4939a48da8ae6f02d0177a2387be4235b0b1b23
SHA512

0748a616bda32c20f8daae9bd65111816f6e1a048c2b360ba8c39acdf8b8ba7997460c81edd74441830ec15224373da04f7f1e10a5182c96417a0ac0a1cc1c39

Score

10^/10

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1436	92175f70c2e1472fcb742e9dc4939a48da8ae6f02d0177a2387be4235b0b1b23.exe

C:\Users\Admin\AppData\Local\Temp\92175f70c2e1472fcb742e9dc4939a48da8ae6f02d0177a2387be4235b0b1b23.exe
"C:\Users\Admin\AppData\Local\Temp\92175f70c2e1472fcb742e9dc4939a48da8ae6f02d0177a2387be4235b0b1b23.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1436

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact