gurcu | e7a656b1ce865f816ddd0a6d7383d7c782f20402e3f906210828d8e613bc5723

General

Target

downloader.exe
Size

10.7MB
Sample

241112-246dcswmgr
MD5

515809a1866e55e364ee8ba179779bca
SHA1

b0ac8c768fd75d9b787bbb90367e7cf43195e141
SHA256

e7a656b1ce865f816ddd0a6d7383d7c782f20402e3f906210828d8e613bc5723
SHA512

9674e954c72421252fa83a70493664e6eb3df4b69ce0ec7794e54b81507c765a183a7432bc455d39f30088007bc6f9048d754896c267781055ae7d08f5abfa66
SSDEEP

196608:swkgYsVEoc/TLx4hz7DIxyhwfI9jACSgYBYvgaHf+iITxLmA6Pk:3trVEJTGz7krI7SgYB6CT5i

Score

10^/10

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7538105915:AAFi09XvfUgbmwvHEx0kUW3xgh_n1In_uzA/sendDocument?chat_id=-4558049798bR9pOWlDh30VNqd2kHj6orRxfc9sN156&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot7538105915:AAFi09XvfUgbmwvHEx0kUW3xgh_n1In_uzA/sendMessage?chat_id=-4558049798bR9pOWlDh30VNqd2kHj6orRxfc9sN156

https://api.telegram.org/bot7538105915:AAFi09XvfUgbmwvHEx0kUW3xgh_n1In_uzA/getUpdates?offset=-

https://api.telegram.org/bot7538105915:AAFi09XvfUgbmwvHEx0kUW3xgh_n1In_uzA/sendDocument?chat_id=-4558049798bR9pOWlDh30VNqd2kHj6orRxfc9sN156&caption=%F0%9F%93%B8Screenshot%20take

Targets

- Target
  
  downloader.exe
- Size
  
  10.7MB
- MD5
  
  515809a1866e55e364ee8ba179779bca
- SHA1
  
  b0ac8c768fd75d9b787bbb90367e7cf43195e141
- SHA256
  
  e7a656b1ce865f816ddd0a6d7383d7c782f20402e3f906210828d8e613bc5723
- SHA512
  
  9674e954c72421252fa83a70493664e6eb3df4b69ce0ec7794e54b81507c765a183a7432bc455d39f30088007bc6f9048d754896c267781055ae7d08f5abfa66
- SSDEEP
  
  196608:swkgYsVEoc/TLx4hz7DIxyhwfI9jACSgYBYvgaHf+iITxLmA6Pk:3trVEJTGz7krI7SgYB6CT5i
Score

10^/10

gurcu milleniumrat discovery persistence rat spyware stealer upx
- Gurcu family
  gurcu
- Gurcu, WhiteSnake
  Gurcu is a malware stealer written in C#.
  stealer gurcu
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Milleniumrat family
  milleniumrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1