gurcu | 6cddd71248af261cfc692b8d0cae07be09aad1bdebde4af458a7a49134f16475

General

Target

Wookies Hotmail Checker.rar
Size

11.5MB
Sample

241008-wwyewsthqh
MD5

91c8611c10297c53a4557aabfb893d1c
SHA1

d8c38950d693b8375ed9c3ce94ec3bc3000a7b78
SHA256

6cddd71248af261cfc692b8d0cae07be09aad1bdebde4af458a7a49134f16475
SHA512

784e0960d0ba6b15f96d2b6409478256f499dcfd2dbc6565ba6e24c97c9ba9cede735591b54fcda20d7022feb07ddfe7a6da6b3d2119f884500f637ac997c315
SSDEEP

196608:yvN0YRZ22QI849Stpf0Tqe80nXeD0cyXCqBgc0/DHr2PSg8J4iBen3934Vslwg78:yvN0Yf22QUBTqe80XeYcyyqL0/jrVJ40

Score

10^/10

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4590251468&caption=%F0%9F%92%A0DOTSTEALER%F0%9F%92%A0%0A%F0%9F%92%ABNew%20log:%0AIP:%20138.199.29.44%0AUsername:%20Admin%0ALocation:%20United%20Kingdom%20[GB],%20London,%20Englan

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4594364141&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0%20kb

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendMessage?chat_id=-4594364141

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/getUpdates?offset=-

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4594364141&caption=%F0%9F%93%B8Screenshot%20take

Targets

- Target
  
  Wookies Hotmail Checker/Wookies Hotmail Checker/Jint.dll
- Size
  
  244KB
- MD5
  
  734c5ce8f9b104d8ad3c7b494e96f9b9
- SHA1
  
  184cd4152b1b65d9531867b06c2e1c215fb872f1
- SHA256
  
  ed618668ae9e7c02c7c2b7332dd09079168cca96432a051044683c996337001c
- SHA512
  
  1e3ac0649e3b7bf9e97681aa7b1346aa44afe96d8c86fc77a6e002b8cf5b14b1a57f19f669ed0d4ae9a94d3f65d4eefa99dcffcf5d74afc8731f913c9c9f79d6
- SSDEEP
  
  3072:hE1DupDOGfyKkpsZa27k5t0f5jjBWV239UDjRFAkqYL36ZmvYYGUaKTUCRaikNrJ:hjyQlGunmvjPa2vRQrXPHNQHsq5+L
Score

1^/10
behavioral1
- Target
  
  Wookies Hotmail Checker/Wookies Hotmail Checker/Leaf.xNet.dll
- Size
  
  142KB
- MD5
  
  2c607159e31c1e091697e74efa5cfebe
- SHA1
  
  874d28447e5c1d7583f413db85049bf17de830b5
- SHA256
  
  056900c587b7e574ccd154a83fe299bada653347c3862076b0ef6035039c0bec
- SHA512
  
  bfe7b463db8f0ef5981b4cdf22d2815ec10a941fb7cdeff4a861626f1fa9a29f913c5e971b257a5d206965e1300328b7530c40692889d9065ab95d63a63fe55c
- SSDEEP
  
  3072:iKpUZ/x+t38Q4I2T4EFWX66sU9/dfYJd:vUZ/x+tMnI2T4/XN
Score

1^/10
behavioral2
- Target
  
  Wookies Hotmail Checker/Wookies Hotmail Checker/Newtonsoft.Json.dll
- Size
  
  695KB
- MD5
  
  715a1fbee4665e99e859eda667fe8034
- SHA1
  
  e13c6e4210043c4976dcdc447ea2b32854f70cc6
- SHA256
  
  c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
- SHA512
  
  bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
- SSDEEP
  
  12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
Score

1^/10
behavioral3
- Target
  
  Wookies Hotmail Checker/Wookies Hotmail Checker/Wookies Hotmail Checker.exe
- Size
  
  11.7MB
- MD5
  
  d3753206b47951f0ae7ce58451a1d36e
- SHA1
  
  8804e6852920a0d05dd2eecb80f5996baa913ea2
- SHA256
  
  e5f88908158c40e919da296c7858860d3d25a9ee6bf738d488c84b065e51702e
- SHA512
  
  1f5a92215fe83bb892f619dc1b31c03cb71d610f002f58c0bf2e4e42e51db61f03021791716f255da08b1590dd38cc773abb90715baab6ac9ecf0004d955dabd
- SSDEEP
  
  196608:XeV5VR5XoQzOQ3QstnxcsIoJRy68CI+qzX6TPcB937fP+PIa8fIVWpuvi:Q5PN7OG7csI96pIVb6TPcr37fGuIspuv
Score

10^/10

gurcu milleniumrat discovery rat spyware stealer
- Gurcu, WhiteSnake
  Gurcu is a malware stealer written in C#.
  stealer gurcu
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral4