Extracted

• • Target

    f19126b02be0b331982e041dc9bcad51.exe

  • Size

    223KB

  • MD5

    f19126b02be0b331982e041dc9bcad51

  • SHA1

    10ab04a6f24ce4540a564041375d8275a691e409

  • SHA256

    2869db18f346049bcc9e378a77ed809fd9caad2fd2bd4d9f58d6e728c784b3eb

  • SHA512

    e6158c6c1563ff3f013b97c0b5da7b5f3301657b948ddb1198ebaea7ce5fc3a9c9f3f449646f45c070514e8796e6315a2afaab7894ba20e3b857a5dc504d093c

  • SSDEEP

    3072:fvfoUJQCw+d+Uoj9DVbDWb0Cdfc6mdSCFytxpNS17e+8TNBfxz9l:fvfoOQHelqJbD4HJe7FytVSle+8TxX

  Score

  10^/10

  gurcustealerspyware

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2