Extracted

• • Target

    downloader (5).exe

  • Size

    70.1MB

  • MD5

    990cb2c6cadc8c36bdf40fb70419f141

  • SHA1

    18b2151d37dd6dea520d92127fc1518a8f344601

  • SHA256

    adaaba0fa5907074e6e35be2d3f1bf97e32b7630ba8bb9eb91797c0795c37e2e

  • SHA512

    a15bd95e953d2c9e4361535f3097e07a049419e14456e54f22d38295e3348e149b1dc703097f00f00f500b7684b63ed1f86dba74139cb9e10c9ab59f55bfb9f9

  • SSDEEP

    393216:lWxQN89qQk4adiJCuE2fUCdod+OvqKkZHzXhJ/KTe8uiBUtkc0k3qjsGg4GUo3NV:lWoI7zGF5ahWc3ImL

  Score

  10^/10

  agilenetevasionthemidatrojangurcustealer

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2