gurcu | 504cb2f584ad2bd425daae92e207db3d973f82517066dfd8a878da6bb9e85b84

General

Target

RogueV6.3cracked.exe
Size

24.6MB
Sample

241010-z43lcsxbnf
MD5

47aa2e1951c06b30a145dfd726bed06e
SHA1

c1a28585761be52073591f285b72943db32eb5c0
SHA256

504cb2f584ad2bd425daae92e207db3d973f82517066dfd8a878da6bb9e85b84
SHA512

790a70183a15b4376ea83d8db441abd0fe1fe2b5c4546b19b01154bdeda552b05b22f397399924eba22125ae96fdc6147fea3eb71e89e2b1eadfacc17f0ebd2b
SSDEEP

786432:45B/kp9tS2+hk6KtrMu+eqs8FKIYmalA:3p9tSpVRu+bs1v

Score

10^/10

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4590251468&caption=%F0%9F%92%A0DOTSTEALER%F0%9F%92%A0%0A%F0%9F%92%ABNew%20log:%0AIP:%20138.199.29.44%0AUsername:%20Admin%0ALocation:%20United%20Kingdom%20[GB],%20London,%20Englan

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4594364141&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendMessage?chat_id=-4594364141

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/getUpdates?offset=-

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4594364141&caption=%F0%9F%93%B8Screenshot%20take

Targets

- Target
  
  RogueV6.3cracked.exe
- Size
  
  24.6MB
- MD5
  
  47aa2e1951c06b30a145dfd726bed06e
- SHA1
  
  c1a28585761be52073591f285b72943db32eb5c0
- SHA256
  
  504cb2f584ad2bd425daae92e207db3d973f82517066dfd8a878da6bb9e85b84
- SHA512
  
  790a70183a15b4376ea83d8db441abd0fe1fe2b5c4546b19b01154bdeda552b05b22f397399924eba22125ae96fdc6147fea3eb71e89e2b1eadfacc17f0ebd2b
- SSDEEP
  
  786432:45B/kp9tS2+hk6KtrMu+eqs8FKIYmalA:3p9tSpVRu+bs1v
Score

10^/10

gurcu milleniumrat discovery persistence rat spyware stealer
- Gurcu, WhiteSnake
  Gurcu is a malware stealer written in C#.
  stealer gurcu
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1