gurcu | f21559ac7c67d871d4f05[.]exe

Resubmissions

13/09/2023, 12:34

230913-prw8psed2710

13/09/2023, 12:27

230913-pm4rzsec8710

Sharing

Copy URL Twitter E-mail

General

Target
f21559ac7c67d871d4f05.exe
Size 327KB
Sample230913-prw8psed27
SHA256 dba8f020ac6d09728422932492657fea3f0a95754cd279f5a949b6982bd32129
MD5 78fd6df30f791c7b5f45dca0b4c952a5
SHA1 d977ca82da0850eb5d4e69c9c657d1a41fb9c44d
SHA512 abf0efb2412c522fbb7f6725a548e8d6a8bc045801a4dd8652a544a1527b99647140ad4843c41a6b00a728a5d8361c7e2ea80eba8ee3b291238729277dad228d
SSDEEP 6144:Vc6sWfGY/yODx332tOIXlU1QWZxXAnuHW9bbGDwVdqe1mM:Ps+CXIAuGG8dA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gurcu

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot5968091729:AAHVag_ncx5c5AIYERGTqv9kr7clJT1_HDU/sendMessage?chat_id=-1001962300376

Signatures

Gurcu family
gurcu

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f21559ac7c67d871d4f05.exe

File Explorer

f21559ac7c67d871d4f05.exe

.exe 327KB

f21559ac7c67d871d4f05.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 dba8f020ac6d09728422932492657fea3f0a95754cd279f5a949b6982bd32129
MD5 78fd6df30f791c7b5f45dca0b4c952a5
SHA1 d977ca82da0850eb5d4e69c9c657d1a41fb9c44d
SHA512 abf0efb2412c522fbb7f6725a548e8d6a8bc045801a4dd8652a544a1527b99647140ad4843c41a6b00a728a5d8361c7e2ea80eba8ee3b291238729277dad228d
SSDEEP 6144:Vc6sWfGY/yODx332tOIXlU1QWZxXAnuHW9bbGDwVdqe1mM:Ps+CXIAuGG8dA
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

339758

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths