Extracted

• • Target

    5a1a37fb68eeb445df8c647dab8af952.exe

  • Size

    48KB

  • MD5

    5a1a37fb68eeb445df8c647dab8af952

  • SHA1

    95f2c1a9ae32d39ed616d2007bbcf6f74feba18f

  • SHA256

    631d7e6e0d9b03928ea24c0f846e3aad741bd675b8837035e8bdc028dc25fc98

  • SHA512

    349c588d9fc96ecf4db16004afec719e00e6ec887a4d89319a150b9ef75b1836fb8dfbff1a1fc0953a0dccf6a27ae117a00cd94c0991ecc70931fd1349cd8d05

  • SSDEEP

    768:4g/hgfJYO9KqosayemfSbvZ5l9GCAPk2/PWC/cEnUSBQtP9:R/hgGO9KrHmKbvtelRJnUSBiP9

  Score

  10^/10

  gurcuspywarestealer

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2