General

  • Target

    I63f8affb2294c837814c33f5446924ba.exe

  • Size

    89KB

  • Sample

    230914-gl9mvahh3v

  • MD5

    dfb3936eb972928af9ec106505364786

  • SHA1

    06a05bf8d2675ea58e44d3fdc0d9e610be021ca8

  • SHA256

    2d1765fd2323db0b7a1b2a4413f793bb6b3a544ed7ba19c1b0d9c4db80747a93

  • SHA512

    e71c24d1804792be45281e70e97d909817e18d0948dcaf86b3e49d22d9f085278b8d043613f1fee0468a28f9e10218ac2cce3315e4c1575f242b324f606e950f

  • SSDEEP

    1536:/JVNAuC4/P1xAqm9wRC+IWMVYJGOupb1cus6SQsjhp5cNbMQaZ9bqk4gxmsuZmQ+:fN//HAqm9wRC+IWMVYJGOubXsjL5wvsD

Malware Config

Targets

    • Target

      I63f8affb2294c837814c33f5446924ba.exe

    • Size

      89KB

    • MD5

      dfb3936eb972928af9ec106505364786

    • SHA1

      06a05bf8d2675ea58e44d3fdc0d9e610be021ca8

    • SHA256

      2d1765fd2323db0b7a1b2a4413f793bb6b3a544ed7ba19c1b0d9c4db80747a93

    • SHA512

      e71c24d1804792be45281e70e97d909817e18d0948dcaf86b3e49d22d9f085278b8d043613f1fee0468a28f9e10218ac2cce3315e4c1575f242b324f606e950f

    • SSDEEP

      1536:/JVNAuC4/P1xAqm9wRC+IWMVYJGOupb1cus6SQsjhp5cNbMQaZ9bqk4gxmsuZmQ+:fN//HAqm9wRC+IWMVYJGOubXsjL5wvsD

    • Detect Gurcu Stealer V3 payload

    • Gurcu, WhiteSnake

      Gurcu is a malware stealer written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks