gurcu | de78b3d62332d442fecdafcee8d09cfe434e1a6397d0c47faf72644d131622bd

General

Target

GoogleUpdate.exe
Size

16.2MB
Sample

241117-j5h1cazlap
MD5

f39ad6c8d4724129b58da88fc2a63401
SHA1

d80f419bd73c56c68b33c4f039f4091dae381142
SHA256

de78b3d62332d442fecdafcee8d09cfe434e1a6397d0c47faf72644d131622bd
SHA512

d351d6976be266b9241a813e20cf607af1d25d3301eb69d4d5713be2595754d1c912683fda6bbcaeb54f07c65b9d4951c0018c6df53d8f35cc9cae693d9a421f
SSDEEP

393216:YKfj0un9prOy3zYxqnmCl4mSVyTHd6u/yCJb:JfIi5OcE4jlFSVK9aC

Score

10^/10

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7538105915:AAHN-yge8e3c4N-VMrU5-ojEq_N6CE_o0_k/sendDocument?chat_id=-4558049798&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot7538105915:AAHN-yge8e3c4N-VMrU5-ojEq_N6CE_o0_k/sendMessage?chat_id=-4558049798

https://api.telegram.org/bot7538105915:AAHN-yge8e3c4N-VMrU5-ojEq_N6CE_o0_k/getUpdates?offset=-

https://api.telegram.org/bot7538105915:AAHN-yge8e3c4N-VMrU5-ojEq_N6CE_o0_k/sendDocument?chat_id=-4558049798&caption=%F0%9F%93%B8Screenshot%20take

Targets

- Target
  
  GoogleUpdate.exe
- Size
  
  16.2MB
- MD5
  
  f39ad6c8d4724129b58da88fc2a63401
- SHA1
  
  d80f419bd73c56c68b33c4f039f4091dae381142
- SHA256
  
  de78b3d62332d442fecdafcee8d09cfe434e1a6397d0c47faf72644d131622bd
- SHA512
  
  d351d6976be266b9241a813e20cf607af1d25d3301eb69d4d5713be2595754d1c912683fda6bbcaeb54f07c65b9d4951c0018c6df53d8f35cc9cae693d9a421f
- SSDEEP
  
  393216:YKfj0un9prOy3zYxqnmCl4mSVyTHd6u/yCJb:JfIi5OcE4jlFSVK9aC
Score

10^/10

gurcu milleniumrat discovery persistence pyinstaller rat spyware stealer
- Gurcu family
  gurcu
- Gurcu, WhiteSnake
  Gurcu is a malware stealer written in C#.
  stealer gurcu
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Milleniumrat family
  milleniumrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1