Extracted

• • Target

    SecureTelegram.exe

  • Size

    37.0MB

  • MD5

    704c4cb99b74b3bf258a99ebe601a9b1

  • SHA1

    ab66a01cb4f912e76ed4af4aa999d80fb63edf83

  • SHA256

    3134316cd5f860361755f9370505e440ee9fd91a2e15ae8c27bf5aceafb70030

  • SHA512

    442c596beb5035c4fad8ef141e889c9d286d93694877a2a82b3081322de04b32c7fade62f7743c7a8852df0a2f3707a075b5ad1bee083a5714d8056ecf3c9259

  • SSDEEP

    786432:qRQBrRSY+R46huYqwAO4YoMGD6Oaf3ooHLl0UAlYBLe+9qz7fEg:qROrRR+R4WurwAO49QvocBAlYBLe+G7R

  Score

  10^/10

  upxgurcumilleniumratevasionexecutionpersistenceprivilege_escalationpyinstallerratspywarestealer

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Stops running service(s)

    evasionexecution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    main.pyc

  • Size

    723B

  • MD5

    c568586fd87462685947012dca4d79db

  • SHA1

    0a899e9cd82c732c565d6ba591a04c0bfdd5a592

  • SHA256

    a8a0c8ebd9254af0e97a710c79eb70e26b063dfd4b31cc96b66e45dee95bfe35

  • SHA512

    5d6ad73872e5e118daa54dfc7a85f1a8d9b7c70565030ba4a764ce00710dbc9f1f72c443a43437f97843857e73718b2b8dbe47cf80c1ec5a993899ad9a4eeab7

  Score

  3^/10
  behavioral3behavioral4