Overview

overview

10

Static

static

3

SkinSwapper.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SkinSwapper.exe

  • Size

    7.8MB

  • Sample

    240503-e14zssfa4s

  • MD5

    4a0bc66968a6315dbb5927c60f634c87

  • SHA1

    e14dcffa065841466fd023cd99a3354f8edc8b9a

  • SHA256

    60177d46c6dc42fd8118a280e0eb2056f05915dde1c24c4f5322e929c73956b8

  • SHA512

    4f07cda2f639e37861cc7681b33e3ec0dd0670c1d095c66f3df64928c5a01357572016f40d7e16e97c2b66018ef2bb711e454de9607f3b0c4d80bb436776ea80

  • SSDEEP

    196608:YrBZS6ykGjALAZRvMDPFnLTuref1hh/TPTS4nz0szTR7Ai:OrygLAZ0nLTuref1hh/bTS4nz0szTRsi

Score
10/10
shurkinfostealerspywarestealer

Malware Config

Targets

    • Target

      SkinSwapper.exe

    • Size

      7.8MB

    • MD5

      4a0bc66968a6315dbb5927c60f634c87

    • SHA1

      e14dcffa065841466fd023cd99a3354f8edc8b9a

    • SHA256

      60177d46c6dc42fd8118a280e0eb2056f05915dde1c24c4f5322e929c73956b8

    • SHA512

      4f07cda2f639e37861cc7681b33e3ec0dd0670c1d095c66f3df64928c5a01357572016f40d7e16e97c2b66018ef2bb711e454de9607f3b0c4d80bb436776ea80

    • SSDEEP

      196608:YrBZS6ykGjALAZRvMDPFnLTuref1hh/TPTS4nz0szTR7Ai:OrygLAZ0nLTuref1hh/bTS4nz0szTRsi

    Score
    10/10
    shurkinfostealerspywarestealer

    • Shurk

      Shurk is an infostealer, written in C++ which appeared in 2021.

      infostealershurk

    • Shurk Stealer payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks