gurcu | ba7339b6ea34396a448e50dccf7a040e06d5b24e32b043bb1f3b9721fccc64a6

General

Target

06579099.exe
Size

1.0MB
Sample

230526-vf3h8sha2w
MD5

0d1d7ca455734423caf384fa41b0a986
SHA1

b3d6d42967ff9eb0bd3d5121ed3369348011aa78
SHA256

ba7339b6ea34396a448e50dccf7a040e06d5b24e32b043bb1f3b9721fccc64a6
SHA512

d6c15767f2ab37d940bc51eb99b27750f23099b49b9908bd24add20f059c923363d8962b10ca4b29b4c3c0a561aa79f2b8b6fb0e88d64335131069548dd157f9
SSDEEP

24576:7yLiMU9O+eW8f5bIT3rpLMblp/EujQAI9MH9hCjMg0c9ImY:uL/y4fOql/KCrCTJ

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

lisa

C2

83.97.73.122:19062

Attributes

auth_value
c2dc311db9820012377b054447d37949

Extracted

Family

redline

Botnet

goga

C2

83.97.73.122:19062

Attributes

auth_value
6d57dff6d3c42dddb8a76dc276b8467f

Extracted

Family

lumma

C2

185.99.133.246

Extracted

Family

redline

Botnet

crypto

C2

163.123.142.235:61068

Extracted

Family

gurcu

C2

https://api.telegram.org/bot5948365373:AAHGoShKq2YoPLHuMrakRbVNthbMABFYHUc/sendMessage?chat_id=-1001620069625

Targets

- Target
  
  06579099.exe
- Size
  
  1.0MB
- MD5
  
  0d1d7ca455734423caf384fa41b0a986
- SHA1
  
  b3d6d42967ff9eb0bd3d5121ed3369348011aa78
- SHA256
  
  ba7339b6ea34396a448e50dccf7a040e06d5b24e32b043bb1f3b9721fccc64a6
- SHA512
  
  d6c15767f2ab37d940bc51eb99b27750f23099b49b9908bd24add20f059c923363d8962b10ca4b29b4c3c0a561aa79f2b8b6fb0e88d64335131069548dd157f9
- SSDEEP
  
  24576:7yLiMU9O+eW8f5bIT3rpLMblp/EujQAI9MH9hCjMg0c9ImY:uL/y4fOql/KCrCTJ
Score

10^/10

gurcu lumma redline sectoprat crypto goga lisa collection discovery evasion infostealer persistence rat spyware stealer trojan
- Gurcu, WhiteSnake
  Gurcu is a malware stealer written in C#.
  stealer gurcu
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2