Analysis
-
max time kernel
126s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
-
submitted
28-08-2023 06:36
General
-
Target
IoFLauncher.exe
-
Size
11.6MB
-
MD5
124c2c589d0ba7dbc966123b3621ac5f
-
SHA1
b15a3bc0ec613d3b7fd72125575c8b031d663bba
-
SHA256
cebf8134aee3762147bed405c5e600631325e635b50d523ca913366dfa1afb7f
-
SHA512
1752480298484c6c30f053e0791c8ad5bb913eaef082d46bfe085ff8bf5c1aa34fbae5b20fc0ac561ba0297a1017b6fa35dc93b1a5fce8641b3ea8d733ae6981
-
SSDEEP
49152:tW125jirp0UyuMdH8offDzJzv8TxXF3ru66taoWRyswvmuT3ZaQYMiL4VYikt+6r:IU
Score
10/10
Malware Config
Signatures
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
GoLang User-Agent 3 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes
-
C:\Users\Admin\AppData\Local\Temp\IoFLauncher.exe"C:\Users\Admin\AppData\Local\Temp\IoFLauncher.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
8.1MB
-
Filesize
7.7MB