gurcu | 52b42bf910eada486b110ef7ffce71814ab9ec61402f26ff717f196de477e06c

General

Target

mainn-crypted.exe
Size

19.9MB
Sample

241122-wyxldawjbt
MD5

3ec040e89d6ff706924f6c266d4060d3
SHA1

b83f9962dbdc6b64c50dcda2f120e26370d07b4e
SHA256

52b42bf910eada486b110ef7ffce71814ab9ec61402f26ff717f196de477e06c
SHA512

b9ca46e03dea44fa115a62b8e58bdd1eb3271dbb48eb097afd163b89a8bf2384a5e4f37ad07897a025cceba25c7c73a27b5b2265a7a36df5a7bd02e8abaf7fd6
SSDEEP

393216:2A2ApeRGjBomjgOElBQ9gCYRhf8BVknLhSPQf+/Wxph7+bpWMc3:QApKGlo9OQQ9Ua3knLh2+HhabpWB

Score

10^/10

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot8041920254:AAErt2Qj5PFwq2rCNeb5RylAVE1eFa18SL0/sendDocument?chat_id=-4541669277&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot8041920254:AAErt2Qj5PFwq2rCNeb5RylAVE1eFa18SL0/sendMessage?chat_id=-4541669277

https://api.telegram.org/bot8041920254:AAErt2Qj5PFwq2rCNeb5RylAVE1eFa18SL0/getUpdates?offset=-

https://api.telegram.org/bot8041920254:AAErt2Qj5PFwq2rCNeb5RylAVE1eFa18SL0/sendDocument?chat_id=-4541669277&caption=%F0%9F%93%B8Screenshot%20take

Targets

- Target
  
  mainn-crypted.exe
- Size
  
  19.9MB
- MD5
  
  3ec040e89d6ff706924f6c266d4060d3
- SHA1
  
  b83f9962dbdc6b64c50dcda2f120e26370d07b4e
- SHA256
  
  52b42bf910eada486b110ef7ffce71814ab9ec61402f26ff717f196de477e06c
- SHA512
  
  b9ca46e03dea44fa115a62b8e58bdd1eb3271dbb48eb097afd163b89a8bf2384a5e4f37ad07897a025cceba25c7c73a27b5b2265a7a36df5a7bd02e8abaf7fd6
- SSDEEP
  
  393216:2A2ApeRGjBomjgOElBQ9gCYRhf8BVknLhSPQf+/Wxph7+bpWMc3:QApKGlo9OQQ9Ua3knLh2+HhabpWB
Score

10^/10

gurcu milleniumrat discovery persistence pyinstaller rat spyware stealer
- Gurcu family
  gurcu
- Gurcu, WhiteSnake
  Gurcu is a malware stealer written in C#.
  stealer gurcu
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Milleniumrat family
  milleniumrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1