Extracted

• • Target

    Elixir Injector.exe

  • Size

    1.9MB

  • MD5

    04095b54d4245dca4aeb05310a2ddc8a

  • SHA1

    4d5bc54fade2e8af35d36ae0cab2c0f835cb7334

  • SHA256

    7014e9a725d8449f588d906d671771ccbf2c253d603205818a5af782a02e320c

  • SHA512

    f666c5f973a67aeb3d56b2055884267f2fd892634c2267dbd0e29965285dc05d876658fa944100bafe572b66061a8a7caefd3b1e650ee9302ae229255a8a854f

  • SSDEEP

    49152:OB8cSz7LU1B6RIML97yovHGfx8UINTPWUznpd:QEvKB6WMBvqnIJx

  Score

  10^/10

  gurcudiscoveryexecutionstealer

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1