Extracted

Extracted

Extracted

• • Target

    65711cb0f3baca62e491743186b9d294b8a5e68bf132cacc5697c2210ac42a58

  • Size

    1.0MB

  • MD5

    786b2426d6e3657f80244cf820acce23

  • SHA1

    72e7ac08436e4c15b4a6f63a60976df5d5e60501

  • SHA256

    65711cb0f3baca62e491743186b9d294b8a5e68bf132cacc5697c2210ac42a58

  • SHA512

    88b360e7de409dd15b375fde34fca920395643add97369a1ce51cddbb29786a717618d747132d9b36479d2bcdcfe2ae6d7837963c289b74651e094dcd7bcdde6

  • SSDEEP

    24576:/yDLLtBWa5JM/78mVbfKe8laUDZTVATGngs:KDLL6aw9lfjeZTe0

  Score

  10^/10

  gurcuredlinegogalisacollectiondiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1