General

  • Target

    ad4f601be8e0069f4db65b7d19d066e0a58705f6a70dd4fc2982ab0de1021952

  • Size

    580KB

  • Sample

    241010-aw98ssxgrn

  • MD5

    618cde762459c080282d9074bdf7f6f8

  • SHA1

    b4a1fa65153e4ecbe505d6e16fee69e51cd0c58c

  • SHA256

    ad4f601be8e0069f4db65b7d19d066e0a58705f6a70dd4fc2982ab0de1021952

  • SHA512

    0edc45b0b6b4ce06bdd603470c2fe70f5b7493957fa74d1c2bf5802d8f4dd377842d1d73ae686c608165f470434bf894538f7ef422faa0c897d948282df07b81

  • SSDEEP

    12288:2aNNTd2p3eZmbtueoiM4TGzqSB3VuVbfrJ/79gUkvjM5a5HGmgZq6:2eTd2pwmbQ9ibWFanavsaxGxk6

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6778517563:AAHWX9Uu5kbGG8tbi2AVnm_iK8s3bKlnB3M/sendDocumen

Targets

    • Target

      ad4f601be8e0069f4db65b7d19d066e0a58705f6a70dd4fc2982ab0de1021952

    • Size

      580KB

    • MD5

      618cde762459c080282d9074bdf7f6f8

    • SHA1

      b4a1fa65153e4ecbe505d6e16fee69e51cd0c58c

    • SHA256

      ad4f601be8e0069f4db65b7d19d066e0a58705f6a70dd4fc2982ab0de1021952

    • SHA512

      0edc45b0b6b4ce06bdd603470c2fe70f5b7493957fa74d1c2bf5802d8f4dd377842d1d73ae686c608165f470434bf894538f7ef422faa0c897d948282df07b81

    • SSDEEP

      12288:2aNNTd2p3eZmbtueoiM4TGzqSB3VuVbfrJ/79gUkvjM5a5HGmgZq6:2eTd2pwmbQ9ibWFanavsaxGxk6

    • Gurcu, WhiteSnake

      Gurcu is a malware stealer written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks