gurcu | f79fbda470eb305348d8a66b3df77c1cf753c21165d0d1741b1fffa9829969d7

General

Target

DotStealerBuild.exe
Size

5.6MB
Sample

240929-yxkarsyapr
MD5

efdc135bf08ac422784451e17cfa20a7
SHA1

e53453a9f597674c94ea81d246d2754f8515621f
SHA256

f79fbda470eb305348d8a66b3df77c1cf753c21165d0d1741b1fffa9829969d7
SHA512

dfb3faf87353693593d3bd98bbbb771b009741dc114f312179205d8022e4d41500a8eea65a580a304db32ae1368d020bef0826c09199d4f13601fdd11679052c
SSDEEP

98304:aGl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Uc:adOuK6mn9NzgMoYkSIvUcwti7TQlvciE

Score

10^/10

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4557737896&caption=%F0%9F%92%A0DOTSTEALER%F0%9F%92%A0%0A%F0%9F%92%ABNew%20log:%0AIP:%20138.199.29.44%0AUsername:%20Admin%0ALocation:%20United%20Kingdom%20[GB],%20London,%20Englan

Targets

- Target
  
  DotStealerBuild.exe
- Size
  
  5.6MB
- MD5
  
  efdc135bf08ac422784451e17cfa20a7
- SHA1
  
  e53453a9f597674c94ea81d246d2754f8515621f
- SHA256
  
  f79fbda470eb305348d8a66b3df77c1cf753c21165d0d1741b1fffa9829969d7
- SHA512
  
  dfb3faf87353693593d3bd98bbbb771b009741dc114f312179205d8022e4d41500a8eea65a580a304db32ae1368d020bef0826c09199d4f13601fdd11679052c
- SSDEEP
  
  98304:aGl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Uc:adOuK6mn9NzgMoYkSIvUcwti7TQlvciE
Score

10^/10

gurcu discovery spyware stealer
- Gurcu, WhiteSnake
  Gurcu is a malware stealer written in C#.
  stealer gurcu
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1