General

  • Target

    ib0905dda0f2c3e0ed1483d05a9f368aaf094.exe

  • Size

    324KB

  • Sample

    231014-mwpcjsee93

  • MD5

    3a4b332f0b65e0590f1fc1f07a516a59

  • SHA1

    0ec94ea9e4e09abf1de65568b8864d21598cbcae

  • SHA256

    aaa5229f28d23d73480f06b29368808f6d23b7fdaa4c5946250084247cf2192c

  • SHA512

    34214d32b15bdf4ec70cf56876f110bdd36cdcd7e520ad0b9dd8ddbd85515f2baedda269dede378f43293c29efab81aec4f95c851a127fbb406c36796c4361c7

  • SSDEEP

    3072:QdrpN/JxLKd5hkMnSFw73WnRO5UrYKBxwK30MIQbkMl+IOc2MZhUeNMhlB+Fp7vM:5PsGI4pfoN32h6SKrbq9blQPffL

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6021370805:AAFbCSlFairNgnxSj8mC6Wtf7PW5yGyWmcE/sendMessage?chat_id=6254396725

Targets

    • Target

      ib0905dda0f2c3e0ed1483d05a9f368aaf094.exe

    • Size

      324KB

    • MD5

      3a4b332f0b65e0590f1fc1f07a516a59

    • SHA1

      0ec94ea9e4e09abf1de65568b8864d21598cbcae

    • SHA256

      aaa5229f28d23d73480f06b29368808f6d23b7fdaa4c5946250084247cf2192c

    • SHA512

      34214d32b15bdf4ec70cf56876f110bdd36cdcd7e520ad0b9dd8ddbd85515f2baedda269dede378f43293c29efab81aec4f95c851a127fbb406c36796c4361c7

    • SSDEEP

      3072:QdrpN/JxLKd5hkMnSFw73WnRO5UrYKBxwK30MIQbkMl+IOc2MZhUeNMhlB+Fp7vM:5PsGI4pfoN32h6SKrbq9blQPffL

    • Gurcu, WhiteSnake

      Gurcu is a malware stealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks