gurcu | bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db

General

Target

d57adb24b010d644315933e7030cbdbc.exe
Size

68.0MB
Sample

241206-rt67ssxpcn
MD5

d57adb24b010d644315933e7030cbdbc
SHA1

6d2c83ce9d75b3e1da11c3fbc1b25fdc3944537b
SHA256

bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db
SHA512

62013bbf6803465736c4b2604464a896b6e7f9f712435873de080b7536839e849e7967b767a6f165225312f4bc809d97e824363939c65e7696611088d190e34b
SSDEEP

1572864:1Laqinl9atVfhVStFs93Vl7BzSh5fVpg88N5/Tud5AU3G86TQMr:1mveHfhVSTs93Vl7BehhHghzU3Jc

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

103.232.55.173:7777

Mutex

6KOgubdg2DSGnIiN

Attributes

install_file
USB.exe
telegram
https://api.telegram.org/bot7898406264:AAEcJvD5oP4JuBuf3i4snVJp7o4fDp7tsuw

aes.plain

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7898406264:AAEcJvD5oP4JuBuf3i4snVJp7o4fDp7tsuw/sendMessage?chat_id=-1002292872097

Targets

- Target
  
  d57adb24b010d644315933e7030cbdbc.exe
- Size
  
  68.0MB
- MD5
  
  d57adb24b010d644315933e7030cbdbc
- SHA1
  
  6d2c83ce9d75b3e1da11c3fbc1b25fdc3944537b
- SHA256
  
  bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db
- SHA512
  
  62013bbf6803465736c4b2604464a896b6e7f9f712435873de080b7536839e849e7967b767a6f165225312f4bc809d97e824363939c65e7696611088d190e34b
- SSDEEP
  
  1572864:1Laqinl9atVfhVStFs93Vl7BzSh5fVpg88N5/Tud5AU3G86TQMr:1mveHfhVSTs93Vl7BehhHghzU3Jc
Score

10^/10

gurcu xworm discovery rat stealer trojan
- Detect Xworm Payload
- Gurcu family
  gurcu
- Gurcu, WhiteSnake
  Gurcu aka WhiteSnake is a malware stealer written in C#.
  stealer gurcu
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Detect Xworm Payload

Gurcu family

Gurcu, WhiteSnake

Xworm

Xworm family

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2