General

  • Target

    ab9ef5fe8ae026b27c4c205e01a5859d.exe

  • Size

    97KB

  • Sample

    230908-ll45ksae52

  • MD5

    ab9ef5fe8ae026b27c4c205e01a5859d

  • SHA1

    42897bc1dcc71fe5d7004d826a361d9900dee6fd

  • SHA256

    0e750fdf87d5db48b182f344f666588d5e293b174bb9699ff6b7bc1f17dce12e

  • SHA512

    3a71cb76da5150043f64388719c23306d6786613632f248d1e0bcc8247b424477777bcb7c488890acb78d4cc9342c27e39a03165aee434b9184dae79994444b4

  • SSDEEP

    3072:T58ua64iBLV+8Boccwbl9bpoJQXLz/Cdf+BA6FVT/Dy:XVZywZ9bpsWv/CoBA6Fpu

Malware Config

Targets

    • Target

      ab9ef5fe8ae026b27c4c205e01a5859d.exe

    • Size

      97KB

    • MD5

      ab9ef5fe8ae026b27c4c205e01a5859d

    • SHA1

      42897bc1dcc71fe5d7004d826a361d9900dee6fd

    • SHA256

      0e750fdf87d5db48b182f344f666588d5e293b174bb9699ff6b7bc1f17dce12e

    • SHA512

      3a71cb76da5150043f64388719c23306d6786613632f248d1e0bcc8247b424477777bcb7c488890acb78d4cc9342c27e39a03165aee434b9184dae79994444b4

    • SSDEEP

      3072:T58ua64iBLV+8Boccwbl9bpoJQXLz/Cdf+BA6FVT/Dy:XVZywZ9bpsWv/CoBA6Fpu

    • Detect Gurcu Stealer V3 payload

    • Gurcu, WhiteSnake

      Gurcu is a malware stealer written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks