Behavioral task
behavioral1
Sample
fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.1edb8aa1adacda31bc98064b1634ddeabin_JC.zip
-
Size
156KB
-
MD5
138370815c888c4362068622ba4d3e5a
-
SHA1
457c66bc68fcc429c0218399fb1b40a446b5daa7
-
SHA256
372950be624691f21ea31e846fda46915ae437dc596fd43e7adce57d12acfde5
-
SHA512
17c90595978c58197091ff97181699c597597f861e050f1ccd84ef89b3e547b4813137fcaf8b806e4167044455f4123ef3949637da26acc035ba8378bc43abee
-
SSDEEP
3072:l8pSsqL+E/5hqnffddeUbQ7x9sK/7UYjEzCSM22YBwpmmgR722BGXOXhqLVe:lOZqLnxhqnCU07PsK/gY4CYOpzCC2BGY
Malware Config
Signatures
-
Detect Gurcu Stealer V3 payload 1 IoCs
resource yara_rule static1/unpack001/fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe family_gurcu_v3 -
Gurcu family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
Files
-
NEAS.1edb8aa1adacda31bc98064b1634ddeabin_JC.zip.zip
Password: infected
-
fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 222KB - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ