General

  • Target

    0a32e2ec770c67261df3f3971d517bea.bin

  • Size

    192KB

  • Sample

    231007-bdcegsah46

  • MD5

    387bee74bd6103f6dfa16b9f08fa2876

  • SHA1

    66e8765fc33cb8e75e7155a11b35f08269915b76

  • SHA256

    1b5e7591eb150688e3180011470832461e1f0ddac3f60e82e9e3341522ef28e9

  • SHA512

    3263e2dfef893d386beb0092db2209ec1c5378640c26b59ab00049772ffa17a99642d5433492308d32dca5fc599b8510c9cf6d29d116ebfbbe4b5a5b526db730

  • SSDEEP

    6144:vO5cStO1QVqR1K1X6kPQytXvLHrLeDLXwMi:fSVqXKFvtzrLevXwh

Malware Config

Targets

    • Target

      34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe

    • Size

      256KB

    • MD5

      0a32e2ec770c67261df3f3971d517bea

    • SHA1

      4dfbe7f3faa5b30b9f93085572496f055b02c5e0

    • SHA256

      34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8

    • SHA512

      636b88f63c5829686581489f0c7d41cbee2c7d1aa5aed1f0e675c05047c7f515df7a2fdddf86ef47d28e92681a483e33f5f87f5f7cc8a7c475e343afc93fea2d

    • SSDEEP

      6144:/GpIP+Oqum37ZUr6dgZTlp3j9bpf3X/ZZ+W0:GIPvqR7I6dgZTvfnfP0

    • Detect Gurcu Stealer V3 payload

    • Gurcu, WhiteSnake

      Gurcu is a malware stealer written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks