gurcu | 1edb8aa1adacda31bc98064b1634ddea[.]bin

General

Target
1edb8aa1adacda31bc98064b1634ddea.bin
Size 156KB
Sample231007-blzvragf7w
SHA256 372950be624691f21ea31e846fda46915ae437dc596fd43e7adce57d12acfde5
MD5 138370815c888c4362068622ba4d3e5a
SHA1 457c66bc68fcc429c0218399fb1b40a446b5daa7
SHA512 17c90595978c58197091ff97181699c597597f861e050f1ccd84ef89b3e547b4813137fcaf8b806e4167044455f4123ef3949637da26acc035ba8378bc43abee
SSDEEP 3072:l8pSsqL+E/5hqnffddeUbQ7x9sK/7UYjEzCSM22YBwpmmgR722BGXOXhqLVe:lOZqLnxhqnCU07PsK/gY4CYOpzCC2BGY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gurcu

Malware Config

Signatures

Detect Gurcu Stealer V3 payload 1 IoCs

resource	yara_rule
static1/unpack001/fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe	family_gurcu_v3

Gurcu family
gurcu

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe

File Explorer

1edb8aa1adacda31bc98064b1634ddea.bin

.zip 156KB
fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe

.exe 225KB

1edb8aa1adacda31bc98064b1634ddea.bin

SHA256 372950be624691f21ea31e846fda46915ae437dc596fd43e7adce57d12acfde5
MD5 138370815c888c4362068622ba4d3e5a
SHA1 457c66bc68fcc429c0218399fb1b40a446b5daa7
SHA512 17c90595978c58197091ff97181699c597597f861e050f1ccd84ef89b3e547b4813137fcaf8b806e4167044455f4123ef3949637da26acc035ba8378bc43abee
SSDEEP 3072:l8pSsqL+E/5hqnffddeUbQ7x9sK/7UYjEzCSM22YBwpmmgR722BGXOXhqLVe:lOZqLnxhqnCU07PsK/gY4CYOpzCC2BGY
MD5 SHA1 SHA512 SSDEEP

Password

infected

fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575
MD5 1edb8aa1adacda31bc98064b1634ddea
SHA1 7dc5aee1dd577b61a41a5001d465f0606bb33618
SHA512 26601df19ed259e48ae9e5a792fdb814d216cae446da5f2518670c25df2111a8df69c8afd2059a49e3f2c84156bb4fa95c9106f348535eb79e29f436df42037a
SSDEEP 3072:GQ2NGV19gqU3pJpfYTCOoShKmECPTKBWFPkl6WQre9Q29bSHXGhrD9HA2AF+q73o:uGDCOoSEmkWeILe9z9bS30AzHe0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86

Detect Gurcu Stealer V3 payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

235694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing