Extracted

• • Target

    downloader (7).exe

  • Size

    70.1MB

  • MD5

    499602a4917bfdd7f90024b290b369b0

  • SHA1

    f1621e8583bf40063e409a293f0c8cff37903033

  • SHA256

    b69d8840ba9740ad103758934ca3b45151244717ebb4b7d6b5a1acbcd0498f7f

  • SHA512

    a224437fb3205ce9da024c7b30415f39574658a43cdcbb4f1ccc077590d13a42d35243f002d91f653c0c4b7ea2072df2aae9878f4d36cbe1c88c9b38a2fd58ca

  • SSDEEP

    393216:lWxQN89qQk4adiJCuE2fUCdod+OvqKkZHzXhJ/KTe8uiBUtkc0k3qjsGg4GUo3Nb:lWoI7zGF5ahWc3Iml

  Score

  10^/10

  agilenetevasionthemidatrojangurcustealer

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2