General
-
Target
g8ae371b2e5be4d5d2d0c05.exe
-
Size
290KB
-
Sample
230913-nktcssbe4z
-
MD5
24acb6ae0ce3f02db7e54d5938e6fa0e
-
SHA1
7da01643bf195b0b11e0afbcf0c4c65056c54627
-
SHA256
fe3f4e398b6d08758c70582e76aaf99c5f917de8a05ad9d67a884a07f695f015
-
SHA512
a4125cb350943943223f6def0e6a06b05bebc85d0af857a04471cc93c1a2f605fc305301a1d91814c31a4c58a4d973c3ae0180fffe15d4d2ae178fc845d7371e
-
SSDEEP
6144:0GPJDpTxT8jWHgf8YJkVHC++VeQPBZnq0LZYSwFxQx9t0B9bdKoqeUIJkDa:7RpmWHgf8Y6/Qp1nLiDKkKyka
Malware Config
Targets
-
-
Target
g8ae371b2e5be4d5d2d0c05.exe
-
Size
290KB
-
MD5
24acb6ae0ce3f02db7e54d5938e6fa0e
-
SHA1
7da01643bf195b0b11e0afbcf0c4c65056c54627
-
SHA256
fe3f4e398b6d08758c70582e76aaf99c5f917de8a05ad9d67a884a07f695f015
-
SHA512
a4125cb350943943223f6def0e6a06b05bebc85d0af857a04471cc93c1a2f605fc305301a1d91814c31a4c58a4d973c3ae0180fffe15d4d2ae178fc845d7371e
-
SSDEEP
6144:0GPJDpTxT8jWHgf8YJkVHC++VeQPBZnq0LZYSwFxQx9t0B9bdKoqeUIJkDa:7RpmWHgf8Y6/Qp1nLiDKkKyka
Score10/10-
Detect Gurcu Stealer V3 payload
-
Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-