Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp
-
Size
77KB
-
MD5
10f57aeea7d69c1fd26302daea446d8d
-
SHA1
a2c2b246233565b7deade7a4e27b9bf521cdb714
-
SHA256
e890b9a76c6f9b47913ad5102fd668b556234c6be3488580577a03ed3f61b62c
-
SHA512
a28fc863f62f48fa26810ae7c099b03fc85b0d2542b3491aa2b5afb54df1114f415636f0ff048d3a8e0d158ff6378403a60c1ad3e3270c49e06ffea85da2ccb4
-
SSDEEP
768:oGJtwP79DfSNRjXkUs/2PC0UjobHXyZ3Bs9naW+9SLQ:9J+P7RKNRjXkUs/2KrUbHes9a3SLQ
Malware Config
Extracted
gurcu
https://api.telegram.org/bot6125631937:AAHzA1e2kkAXSFSX6lSoyDACqaM80kXHnEw/sendMessage?chat_id=6155788902
Signatures
-
Gurcu family
Files
-
tmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ