Extracted

• • Target

    c5e1fd07be471ee2a06dbf2871be795fa09f1023a282c3b428ba4ea61a9ae596.exe

  • Size

    5.6MB

  • MD5

    63fdb37fe9bef5bf227388ff266128e3

  • SHA1

    4e07d5d4cd852890eec051be59f596d9a8c91354

  • SHA256

    c5e1fd07be471ee2a06dbf2871be795fa09f1023a282c3b428ba4ea61a9ae596

  • SHA512

    d72cf6499c7ec6639ad980dd049eca2052a95714fd54e88ad17af1bed4f1b7c1a20a1fdaf35c129a919fee4ec6e89471d56c4e4f5cdd04ff29a820753eb5bdab

  • SSDEEP

    98304:aGl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Ucz:adOuK6mn9NzgMoYkSIvUcwti7TQlvcie

  Score

  10^/10

  discoveryspywarestealergurcu

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2