gurcu | whitesnake[.]exe | Triage

Sharing

General

Target

whitesnake.exe
Size

344KB
MD5

aec814bf30dd191b641feef457a718ce
SHA1

96c2bea5b416d10a2dae60acd2b7f9c7cebb8115
SHA256

446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89
SHA512

fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0
SSDEEP

6144:SXRrO+JguvyIs1DkhmgPZw6JXAL5+9bbYZQ4:ir/9m3cYZQ

Score

10^/10

gurcu

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6202531839:AAHT41T-v1F7LRPMrYNhW3IEdF7Ab7I7uTM/sendMessage?chat_id=-1001903439899

Signatures

Gurcu family
gurcu

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
whitesnake.exe

Files

whitesnake.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 324KB - Virtual size: 323KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ