Extracted

• • Target
    446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89.exe
  • Size 344KB
  • SHA256 446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89
  • MD5 aec814bf30dd191b641feef457a718ce
  • SHA1 96c2bea5b416d10a2dae60acd2b7f9c7cebb8115
  • SHA512 fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0
  • SSDEEP 6144:SXRrO+JguvyIs1DkhmgPZw6JXAL5+9bbYZQ4:ir/9m3cYZQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gurcucollectionspywarestealerdiscovery

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4