Extracted

• • Target

    ReanProject.exe

  • Size

    1.5MB

  • MD5

    40a341513f036e4d5a356f70db6afb15

  • SHA1

    2bde15455a425f52fa221577c22db34f217a69a5

  • SHA256

    6858bca15eed33e61fdc4be3f87a0dfe63ccab54a659de551fcb5df52af060f4

  • SHA512

    2610c45c2683f4773238a99e674aba88d64a45ba3f6bb97a13fc763d13d778519727bcf6087d552d40ad80de2e7cdf23379970fc3ee90bb969fe3c9a0216aa3e

  • SSDEEP

    49152:CzS8CQJK7u2Bg76XDnjmj+e8PgnaADNAr:0SxQJK7XG6L8+e8PIaADNAr

  Score

  10^/10

  gurcudiscoveryexecutionstealer

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1