Analysis
-
max time kernel
635s -
max time network
650s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
-
submitted
20-12-2023 01:43
General
-
Target
30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030.exe
-
Size
541KB
-
MD5
3f4dea6e7b8ccf697d2936176954b390
-
SHA1
4b34af92af1e22a6ec47ac36dc4b5bb5d743e01d
-
SHA256
30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030
-
SHA512
e6d5c74048d2510a9ed8dc253158a1f531d61492832238b1c2f5c7c857da57008af1f8d3cd34d5b3077f307c1d42d61f36fd47e40567323d5cd4552fdc46256d
-
SSDEEP
12288:jmWfpP7y6eXLpjblm8wrDGXnPD5pIvJwpTrvX2Hn4Zuc374hotEwOu3LE:jmUh+LLpjblm8eDGXnPD5pIRSDXkg8io
Score
10/10
Malware Config
Signatures
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030.exe"C:\Users\Admin\AppData\Local\Temp\30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030.exe"1⤵
- Suspicious behavior: EnumeratesProcesses