gurcu | 4a665905b9f38b14bdf6df4534d4be7e1f1f66e18c117fdf09bf3ae113e7f9ae

General

Target

SwissArmySuite.zip
Size

33.6MB
Sample

241202-se4nssvjel
MD5

43a2c8d8d0b226bda140b1e4867b74db
SHA1

a041dcc61b5a2ef098f3c12dcc24b05d4b573ed4
SHA256

4a665905b9f38b14bdf6df4534d4be7e1f1f66e18c117fdf09bf3ae113e7f9ae
SHA512

4c2f1e48c599bef7923d6d923973a25e8569a31851b3ad07e4debc0a3f996142959a785d23ed7f55903c290bea573a6bf9d014231bf9bed72776838ef46ce5a9
SSDEEP

786432:/023Xy+8BYtbiDogGMhRNenIWUvCMIJQHdPBRfTSig78vflQ4p:/pC+gw6HNeIxvCRS9D7mAvy4p

Score

10^/10

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4590251468&caption=%F0%9F%92%A0DOTSTEALER%F0%9F%92%A0%0A%F0%9F%92%ABNew%20log:%0AIP:%20181.215.176.83%0AUsername:%20Admin%0ALocation:%20United%20Kingdom%20[GB],%20London,%20Englan

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4594364141&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendMessage?chat_id=-4594364141

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/getUpdates?offset=-

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4594364141&caption=%F0%9F%93%B8Screenshot%20take

Targets

- Target
  
  SwissArmySuite/SwissArmySuite
- Size
  
  12.0MB
- MD5
  
  e76d4577e5b8c4fe7ca8afb031f68e2c
- SHA1
  
  05a644a46c2ac2a450a3472c2eac28b3040a42c9
- SHA256
  
  271447df3a48c399f489075425ae05cd69f21de5790ed53ed4c3d30b623adfd3
- SHA512
  
  50c429cada9823a8fcf3c14901bd80ff61dbecba10ceded85e03e9d4333ada9d40717fc18b5d38f858ce3d2a49d520d8b43390e56ec0e013fa5b9e9c7db658db
- SSDEEP
  
  98304:7tvaLvw3foPoyQoBDCFZeOQ5olEE+dCO3TQ6VwzbIlzoKcB4h2WdU+0Er5rM6uF:cDwwwjEC7OdExO3TdzsQ2GDr5ryF
Score

1^/10
behavioral1
- Target
  
  SwissArmySuite/SwissArmySuite.exe
- Size
  
  19.5MB
- MD5
  
  11d14c97869ea381661418d7f7ed24f3
- SHA1
  
  1ad45d4bafe7b62c61960d212fa61011a43c546b
- SHA256
  
  703bd75c721e362922484aed47f52a25e70e9e6555b01e569f460753e6b64dc8
- SHA512
  
  2b15c4c412e4f182a9c6329001f83d67f92317afa90c4d86bcffdf59f87e44d42ca82d74d880927397465bc3ae7d265a99485d03c824c081e71c7a6fc2f05adc
- SSDEEP
  
  393216:GB62IN4Eg5zDmMStlgQYrMUGBuaUrs6BlLN:GB6X4N5fmMHRu7Ug6BlR
Score

10^/10

milleniumrat discovery persistence rat spyware stealer gurcu
- Gurcu family
  gurcu
- Gurcu, WhiteSnake
  Gurcu aka WhiteSnake is a malware stealer written in C#.
  stealer gurcu
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Milleniumrat family
  milleniumrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral2 behavioral3