gurcu | 982007b8100703183c8b4715a57be7129a3b6c695ff971afedfaf3cdef509e7c

General

Target

Update.exe
Size

5.6MB
Sample

241108-ynw8zaxpfs
MD5

f668e23b162b29408d106d7e33026df4
SHA1

f3a67a810ab1b737c3f63ee9556feee17516a6dc
SHA256

982007b8100703183c8b4715a57be7129a3b6c695ff971afedfaf3cdef509e7c
SHA512

bcda79e81dfcdd017b06137c7f6b8286492b161f6b7bf028c60e28481160120f695e1351d2ba0b967e3468e13e39388b539623d17ee734b2d5ba46db1da550bf
SSDEEP

98304:jitl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Uc:jzOuK6mn9NzgMoYkSIvUcwti7TQlvciE

Score

10^/10

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot8120686609:AAFFbHJYN8XNfebk9woXGBYglnP_6w4ugW0/sendDocument?chat_id=-4597951127&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot8120686609:AAFFbHJYN8XNfebk9woXGBYglnP_6w4ugW0/sendMessage?chat_id=-4597951127

https://api.telegram.org/bot8120686609:AAFFbHJYN8XNfebk9woXGBYglnP_6w4ugW0/getUpdates?offset=-

https://api.telegram.org/bot8120686609:AAFFbHJYN8XNfebk9woXGBYglnP_6w4ugW0/sendDocument?chat_id=-4597951127&caption=%F0%9F%93%B8Screenshot%20take

Targets

- Target
  
  Update.exe
- Size
  
  5.6MB
- MD5
  
  f668e23b162b29408d106d7e33026df4
- SHA1
  
  f3a67a810ab1b737c3f63ee9556feee17516a6dc
- SHA256
  
  982007b8100703183c8b4715a57be7129a3b6c695ff971afedfaf3cdef509e7c
- SHA512
  
  bcda79e81dfcdd017b06137c7f6b8286492b161f6b7bf028c60e28481160120f695e1351d2ba0b967e3468e13e39388b539623d17ee734b2d5ba46db1da550bf
- SSDEEP
  
  98304:jitl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Uc:jzOuK6mn9NzgMoYkSIvUcwti7TQlvciE
Score

10^/10

discovery gurcu milleniumrat persistence rat spyware stealer
- Gurcu family
  gurcu
- Gurcu, WhiteSnake
  Gurcu is a malware stealer written in C#.
  stealer gurcu
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Milleniumrat family
  milleniumrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2