Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d

  • Size

    62KB

  • Sample

    230923-zmpceaad3z

  • MD5

    5f0bbf0b4ce5fa0bca57f1230e660dff

  • SHA1

    529e438c21899eff993c0871ce07aff037d7f10d

  • SHA256

    a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d

  • SHA512

    ddede174b3aac4bbf434e1d61da8fa858b4bde11850a75b113376dccb7356f054a9fb696f498cb01c040cec33bb03d75c8c7b2787d46fc33569aeb753ee16131

  • SSDEEP

    768:I6rewtkBtW3vKSuJS4/bk/4wYMucso7ufooXRsG4TsJOTYp/eKcZbsDzmiKwnq+R:nkjWfKSYS4Yfso8DXt4IroJqYPmkK

Score
10/10
gurcucollectionstealer

Malware Config

Targets

    • Target

      a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d

    • Size

      62KB

    • MD5

      5f0bbf0b4ce5fa0bca57f1230e660dff

    • SHA1

      529e438c21899eff993c0871ce07aff037d7f10d

    • SHA256

      a4c58de9ff779e2b5c28d35dde1884891ab419e909e42c5a164ea576d8348e6d

    • SHA512

      ddede174b3aac4bbf434e1d61da8fa858b4bde11850a75b113376dccb7356f054a9fb696f498cb01c040cec33bb03d75c8c7b2787d46fc33569aeb753ee16131

    • SSDEEP

      768:I6rewtkBtW3vKSuJS4/bk/4wYMucso7ufooXRsG4TsJOTYp/eKcZbsDzmiKwnq+R:nkjWfKSYS4Yfso8DXt4IroJqYPmkK

    Score
    10/10
    gurcucollectionstealer

    • Detect Gurcu Stealer V3 payload

    • Gurcu, WhiteSnake

      Gurcu is a malware stealer written in C#.

      stealergurcu

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks