Extracted

• • Target

    s.exe

  • Size

    22.2MB

  • MD5

    c3ce667a9cc72a2177539a1c6a56d497

  • SHA1

    724cb32ba6d00731d3c86ef93ccdb67e2218711a

  • SHA256

    aa8fe5692f9327c2e7d8c68f4704eddc3683de8e3f9a551bc143e08617dcf255

  • SHA512

    a5d493455e839072da357a0f480cef7065755a8ffaa1efaacb0baaaf068edd08be33e8d75604e3aa3387afebbf8dcc63bf842a4664847b06b5771f9575d6aceb

  • SSDEEP

    393216:kMAoC5YsZlSzaLTyIjuzU5/HngENKEZpjr7wEO4Az8JJcJq9K1Ch7Raj28SH5U:kMC5Y0xzqsgKKUrFe8Dc8Jz/8SHa

  Score

  10^/10

  gurcumilleniumratdiscoveryevasionexecutionpersistencepyinstallerratspywarestealer

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat

  • Milleniumrat family

    milleniumrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies visibility of file extensions in Explorer

    evasion

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Contacts a large (1319) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1