gurcu | 645e274fec3723d065308f9b16b33392ed7f51fbd5ffc3c00806c2efafb08b65

Sharing

Copy URL Twitter E-mail

General

Target
Autorisoft.zip
Size 17.9MB
Sample241222-rvd8ea1per
SHA256 645e274fec3723d065308f9b16b33392ed7f51fbd5ffc3c00806c2efafb08b65
MD5 5b879f39e57139ab17300879afa61554
SHA1 a18eab8e257c611f72ea92833584fff0ffaea1f2
SHA512 54814430828c204a8b606c000e2efc1fb2586f41c322ebae44d9eba4d297db473d37b520fac02c1bf88407a8a9138a3e7de502e27e32745cd4c96d54c9994ac0
SSDEEP 393216:ZE8wps0kxrkXICtuuL8qgk/H0uxE14p4RToEXkk6hFFh:m2BxoXI6gk/H0u/p4nXkke5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

65.108.29.210:21638

Attributes

auth_value
ad39d6a8ea7823f2a92f57ebaa4c98a5

Targets

- Target
  Autorisoft.zip
- Size 17.9MB
- SHA256 645e274fec3723d065308f9b16b33392ed7f51fbd5ffc3c00806c2efafb08b65
- MD5 5b879f39e57139ab17300879afa61554
- SHA1 a18eab8e257c611f72ea92833584fff0ffaea1f2
- SHA512 54814430828c204a8b606c000e2efc1fb2586f41c322ebae44d9eba4d297db473d37b520fac02c1bf88407a8a9138a3e7de502e27e32745cd4c96d54c9994ac0
- SSDEEP 393216:ZE8wps0kxrkXICtuuL8qgk/H0uxE14p4RToEXkk6hFFh:m2BxoXI6gk/H0u/p4nXkke5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  Start.exe
- Size 301KB
- SHA256 b371eae7b55688d307b653759c2d4ddfe3672eb7b5567bcfa9c3f75f5c6d6255
- MD5 9a0e31ffbe7ecc3a2a6f968b2a8d5567
- SHA1 e88e76fe96616649d2558923afe457ce3b1976ec
- SHA512 db64b27997e5305473572ee8a60573032e51fbfbdc48670d9adef8ba23c81e8845d073383299c94f87a0100c74ca0e6968b9f468fc46e31e221a71ad69a32749
- SSDEEP 6144:S1eFfHQTBVVzJxmKg/R3xNJyZsMoONeL1Ip4w3qm:gPBV9JxmKE7JfVONUGqm
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

gurcu redline discovery infostealer stealer
- Gurcu family
  gurcu
- Gurcu, WhiteSnake
  Gurcu aka WhiteSnake is a malware stealer written in C#.
  stealer gurcu
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Suspicious use of SetThreadContext
behavioral2
- Target
  gui.lua
- Size 15KB
- SHA256 1cefe4067f5dfa55873072a76b5b766f19115550cd405b6eee9d222d9bd5436d
- MD5 3fbaf076d7134a8aee08b42125cdef51
- SHA1 54a9d8bdda809ec0b40e574f1ebed8e39b0f166a
- SHA512 649e252af9f88d72827907bfce085e28d5309b7d9cade27fd652cb4ecf5645f040842c4b9f13f4239bf8b5f4ceaa219c3f8ef4aa5dcd92a6c44cd9948580875b
- SSDEEP 192:QC8HPhbdPHR/LvS5ZiLRRi6tAExVWkHbWRRQxQIXjWYUNPJodWtHS8HT:QVRxRjv/mCxJdzzIZ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3
- Target
  internal/extensions/CMemoryBlock.lua
- Size 141B
- SHA256 400bc118e420ab428675226e08a2cba5e0bd4121834168a5fb9b8004502ae3f0
- MD5 5061c2e693ba5c470b76fd4b2ce7be24
- SHA1 ec721428eea0d08bf501cc428cea046e3774152e
- SHA512 c0168746854c5ddc3496dd9a2b5ac97b62d0eec2fc6a4c7fa8ef0676b08f753525bceefdd0ac9040f1105c83544b583ef47ff0ab1bbed09d0b054122087d3c91
- MD5 SHA1 SHA512
Score

3^/10
behavioral4
- Target
  internal/extensions/CNativeReg.lua
- Size 3KB
- SHA256 20298293eaf7060ea4cf99a5b2e790471431166fe618b1032719b01d5d00adc5
- MD5 6b75b1d3f480dcf226ebacff62d35165
- SHA1 b170d5079a507e9f9fd918ba993498cecb5b69b8
- SHA512 4a0ebd56072f0415f79b79c1ccad3b1acf334a9e8e07e671b27297a9eb6dda1ae34e7c44dc98029f4e8da8e43fe33fcf560fc098d2267312182576f7461e871d
- MD5 SHA1 SHA512
Score

3^/10
behavioral5
- Target
  internal/extensions/CScriptThread.lua
- Size 2KB
- SHA256 d9721aab78d7afa65ed289ae619ab06c6ca86f1bd1e30bd6f16bccbc5369518d
- MD5 140fa886857b0ae6e7caf21019d55bd7
- SHA1 8b0fd588739dd2c8321f59f2c125a7478e304357
- SHA512 0b88422b08c0f62adad6fc1ec955358ad18e71fd13095a9641ac0037d827af124fb4a64c9e9515d8b6a72f1dabc924d5b52b5c52fac06c06d1c68f2b42c17667
- MD5 SHA1 SHA512
Score

3^/10
behavioral6
- Target
  internal/extensions/CScriptThread_EventHandlers.lua
- Size 2KB
- SHA256 fa1c4d1944b33c32f9155ea2512c397fb360b7fef6b90cd24e8ca1101d1d8a7d
- MD5 1e4b4833d2b1f669c19adba54710adc7
- SHA1 5337039b5b89b9d587f3edd574d4763c9cc7fb99
- SHA512 a9fa97af54d7c64f7c19752571398a5bf8d61cc72195534f38b9032c6e9beee2b253146c84346b2907500f864f5aee61a4d132ca18ce1907c5c873655a69ae8f
- MD5 SHA1 SHA512
Score

3^/10
behavioral7
- Target
  internal/extensions/CScriptThread_Timers.lua
- Size 1KB
- SHA256 89b849bd208de27791887738d84a2c20f1e6be9acb5b5973459e097fa6c2e26a
- MD5 9e26a3f52653a2bc26376665de16460a
- SHA1 819f322e928a3e969a7e1e2cc92b4c774119587a
- SHA512 421df6874e7d5931288818687332b4eaa388560956238edb6e127f8033705dc97ac2de18487e0c2fefba264021f1dbec31c588984dd71275ac814eec687bce7b
- MD5 SHA1 SHA512
Score

3^/10
behavioral8
- Target
  internal/extensions/Vector.lua
- Size 576B
- SHA256 32eb9be018ee9e6acc74b70a6658daa1517590c6d9a67bf42d1ea1b1226271fe
- MD5 7e3a9e43cbcc2f696d3fe5e98c25bd40
- SHA1 b8bb6f8641b2ca5bddf80093bdaa29aa1f17806c
- SHA512 06e7c53a14fe1b5ea7b00deb33f2370738722933bcf034c6722dc62f0008212ef8cfb3cfc7cfe8e5f7d04b324d7de2b4fe0767b87366133e278f8fdd1e8e952c
- MD5 SHA1 SHA512
Score

3^/10
behavioral9
- Target
  internal/extensions/keycodes.lua
- Size 2KB
- SHA256 feef07106680ddb04400c161e42999e2dc183304a5edaf36dd934d61c24e16b1
- MD5 35bec02284cc87dc505d48987f115d09
- SHA1 22c571a9e4ea449a59612042ed63434b57157159
- SHA512 b19c460fb0d5074f25f1a3e8d1f48d7f5823a34bb3cad34bebf5141f4c2b585087c3ccc7e2383bf01998f907f7957efe2f6ecb93b5beaef8f9002fe0b6ec50ca
- MD5 SHA1 SHA512
Score

3^/10
behavioral10
- Target
  internal/extensions/vehicles.lua
- Size 13KB
- SHA256 33aceffacff3af61fe5743c9debd7968e352a2cda0d522d4dca7c68a8e17974c
- MD5 f4af2d671434c49b996e782557d5910b
- SHA1 ed487d8e687b38e771483429984bf0e93d98c44b
- SHA512 38691c3c84cdc4a87f3deda94b9bb4fad1d8137cc26b8f631c0a7b8daf2649e7af284efccee208c0f6e129eaf26ce45e477f372f4c6c8823bb5a38b1e60fc6af
- SSDEEP 192:L6+1F3MKGh8gLQyNK7axlrAnwHOCG29OadTdLx0HMmdQu8PMISQ3bNV8C366:r28gcyIhndQu8ko3bNV8C3N
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11
- Target
  internal/game/AI.lua
- Size 1KB
- SHA256 ea9c8d9600b9caf89e41a79179c29f4757caa12346f49b2b498ad37a1c13f4e2
- MD5 41e9918bf7c6e12a5b74d4c434b6483f
- SHA1 fea13f9221143521b5e78300e056f33587376e7b
- SHA512 5ee3901b2d00337e904ae95377cc978738239d4ec549fbdca351e4e6d41a2228359bacb857e05f83c86168bede1c3fd57731b28e0fd26e6ba410da79ab54d67c
- MD5 SHA1 SHA512
Score

3^/10
behavioral12
- Target
  internal/game/Blip.lua
- Size 4KB
- SHA256 9462b7494aa4ff6ed75e233c3d0f2cb917ac9424242fee7f5ba4cdc9c7727668
- MD5 2584beaaf6f7fe130173859ad9084f70
- SHA1 9e56047a3eedc8ed091705dffc1730569c13d1be
- SHA512 2ee78a07047de92b3fda31b1c37e606f86cf3ece82d998efa399a7018be8a280369050512dca9b6eab2ce36859ae332c22f17278c226628004675857acc4a503
- SSDEEP 96:I+FdpvfKn5sAt8bV1m171t5gA9cOzpGmSWuSYgj2AYzA9D3heuqxyaEQwMB19BN:EpIWTo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13
- Target
  internal/game/Entity.lua
- Size 4KB
- SHA256 24aacf0e6d8f04ab81422bd5dc26f23a0a23bb568b3e63817461aef5a4eaf0ca
- MD5 06bdd4eb79303b245bed52d357a26592
- SHA1 46c70e677259a87dea385552122e981f760b5537
- SHA512 0b0c1b2557959876005fabaad4c184d77e1aee5fbb3f19a6ebf378410b42c7fdc9794e322e3199fede91bc3cb15647a0eee8d022fb8c67a683eaee9175e24526
- SSDEEP 48:V+bz1bnXscHPm+hhrJhWjIIrxN7ovkvwj6G76WNIxUdimjkLKjTHY5CRca28eRfx:Vczj5+jbSv9LTtSS2so55OKV1
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral14
- Target
  internal/game/Object.lua
- Size 95B
- SHA256 a77f0b448eafd9fea35835629e4480b911bda3faa402a996d813db13867e512b
- MD5 b91ef87c27f50a0027b7e1c82be520bb
- SHA1 d01c21a6fab3ad8239970255867e40369dacde72
- SHA512 514df7a7101529b035b876c519a27619349f8575f0c58e5eba357b10bb8058f9e105fa7ea97ff6f5aa5a3fa064699908099cbd6f8aa9903c740c12779b430a50
- MD5 SHA1 SHA512
Score

3^/10
behavioral15
- Target
  internal/game/Ped.lua
- Size 3KB
- SHA256 91e8479efd50675e99f568a0f835383166aed7b146890e72029de7dff54d4ae8
- MD5 5c6c7835bd200461fd5c22b947278c63
- SHA1 75d8cfd0b0a2278f1f821c97ea7e07a5e75095c4
- SHA512 207b3d26e54c0c0f02377e5324cdf089133f69a8f401287ac998e860f874e98f441ea99bad7d0d4a8c239d17812f9c1f3713ca19c9af2f074ddd1260b3934eaa
- MD5 SHA1 SHA512
Score

3^/10
behavioral16
- Target
  internal/game/Player.lua
- Size 2KB
- SHA256 8834faaa4d652e92280bb0eedf512415aeb8d9c9a96cfb0eb8a89f79fb478a44
- MD5 a2fb43a0016aed325d6e446f1e95563e
- SHA1 c795894a124e07ba1d321cbb23b884f67f9b837e
- SHA512 0ae87b81c74b371bd50e1efaa2a1bd464761b711dee139b0669681b2b7cff40a1ef212aa2ddb171b0ae6da8f7f3d8f29c3706742ee39288ee21e5d1807a42927
- MD5 SHA1 SHA512
Score

3^/10
behavioral17
- Target
  internal/game/Vehicle.lua
- Size 2KB
- SHA256 a5a352ed24c0a51b2c643e09082577c13272109c3e5a3b30065949fda92e2e89
- MD5 bc7c05407fc93b9f8287bdeda40ed607
- SHA1 145b6ded820421071b63e7b9a3f2f10b85840fa9
- SHA512 f1c073bfb081bbed0b7cfeefa89533d5e8a7e1befc7589cea6332853921cc6367e8d52e4b7daddfa00ff7ed58a887bc4e04806c7f7374a7dc69bedf5a74d0a4f
- MD5 SHA1 SHA512
Score

3^/10
behavioral18
- Target
  internal/game/game.lua
- Size 988B
- SHA256 14090f2b5dcc0b51481fe2d554a0c2571df581ed8461804a8470748eabbbc7e4
- MD5 84f78077881d1db0c50e6af53f0aac61
- SHA1 f178bcfa6d2fd08bdfe31e47337db4b032792c2b
- SHA512 46cfc883eb62c6df3667d007f25823651284c0c396302af36e151faf80bbf51d0c2d6181f56b6dfe428cf8bc573ba6e4054fc899578f83b02660fd4be0cef51c
- MD5 SHA1 SHA512
Score

3^/10
behavioral19
- Target
  internal/game/graphics.lua
- Size 360B
- SHA256 e1c4af5626ac51864a0d1a37e1d27eee97cee6bd39ee7321fc98919ed9198ddd
- MD5 797d47365b5353d27faf6b5f5506436d
- SHA1 13a27036670437a9e5ac8b4798d52b9a7f70eb71
- SHA512 94684dd1829e56c44eb4096dc442968324ddc06f6cb67baafe43a0372d724ca39f13f21c622e390ce4fec2957f72eb9517306d480d5431104fb627202e30e4e1
- MD5 SHA1 SHA512
Score

3^/10
behavioral20
- Target
  internal/game/gui.lua
- Size 1KB
- SHA256 5f93f802370b61fa279998a67aff86e44f97478550137985d5c7e7a1a0986899
- MD5 f7ff6f25fb657b7342061097d57259cd
- SHA1 e94d3d8be1c84ef1849fcae109cf5946f272f9e8
- SHA512 e651e3dbed51be1614e456d84efc16dc8580b094c95395361b627f71a588b26d8f7377469e9d559ed7f675ec835a51da2236f96e60e5577c63268e52cdb7bb6f
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral21
- Target
  internal/game/gui/simple_menu.lua
- Size 3KB
- SHA256 fd75f51c7339d38bf6b529883d60deb71b50ae1c56d714bf276f6eeb0d40a3d8
- MD5 a7e72aec10e229d667dbf5327f6332cf
- SHA1 fe852609ffe4fd8a0a8bfc72d8627b5e2ea8de15
- SHA512 c916d76fa6aab0b565d3c6f732a1a46c9cabd04a4f82fc0c592f44a593d926d1486e3c327743cfef9041c2e676be5cb6c5549bbfd52266c5f58d011d06a7cce8
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral22
- Target
  internal/game/streaming.lua
- Size 918B
- SHA256 1cb0d90f5fa4ef240dafb927d0b4bb42f0d9193f94fe35cbdf8f23c09aef267c
- MD5 030f4ede052289725a371346c901e214
- SHA1 93af2eefb1d6ed97c92731900e69f91d6d887eea
- SHA512 6cbd06e189fe0056280fbeccb8c9bbb24712c44b5f087667447f5254fa028d57c529f323d5ebe4244c60f4af3012727775455ae55051117243929f27e3e7e183
- MD5 SHA1 SHA512
Score

3^/10
behavioral23
- Target
  internal/game/timer.lua
- Size 914B
- SHA256 7efe04e85f03352758487b4fef035aa1b86eb37dc6c245956e45fefd3cf20826
- MD5 287a06dd83498b4ba8a43238fac364f4
- SHA1 abfa97b8484071ff1f24444b497e036d84cc7c3a
- SHA512 939311cf15130f5d7d97624fa8a76b790d97a6f53eca3646252c6f5fe1dbce0e49bd957c168ad02567f4df5b81449b4cfd457fe24ac756fd520dd4731d7cf8f2
- MD5 SHA1 SHA512
Score

3^/10
behavioral24
- Target
  internal/game/ui.lua
- Size 316B
- SHA256 ab87d40c3ef93a1102aabfe67925746989dc071cdd480f10c832ea7881b4e573
- MD5 5d7f6836b8ae45662c627191b73fa10f
- SHA1 578208001155f850540ef6bd2ddd7e4c15c22e5a
- SHA512 fb48d06b4c7c79a48c3f8c90fb60cd37c53fa152b38a72b2be99731014ed43b5cf0fe2b25ae010b0d94619158783d560d2628e781fcc365d06941cc685764283
- MD5 SHA1 SHA512
Score

3^/10
behavioral25
- Target
  internal/main.dll
- Size 17.7MB
- SHA256 45badcb0e32204c755756519eb2dd4a092c71e3b725fcb95030940325daa31f1
- MD5 207043268b10e01caa9fe94dc0e3526a
- SHA1 ca12ab61b785a300da52830451d6c6604e155668
- SHA512 3075c9da2f4126d6d741db9f777e84fb4bd270061ef694805bbba25285d6764a9b5bbe2e8e903dc170ee4b441666f38c3c9868732eb52f7e5aa4fbd6a501701a
- SSDEEP 393216:M9NRsOLlhL6jer0YWJgITBRFVUFOdlkucXp4G3TeeKTeXzn:GzsslhL6EITBLVTcXqiTeeKTG
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral26
- Target
  internal/main.lua
- Size 1KB
- SHA256 3cc0ed16dda7e316717d8b332114e6bd991e392fa344be7237bf3016e90c08d5
- MD5 43b95708754f6bea8c7afda47d8cac50
- SHA1 193f7d652ccbdc801421dbffa7003b5f84de7982
- SHA512 5e07a76df6e8ed16f6f625611b9f6f472963efb1b843c1aff96defe7a7b83471b7c3794c56b7722383b222320c265b84f6140179d82eabc4ee6785cd04afd4b9
- MD5 SHA1 SHA512
Score

3^/10
behavioral27
- Target
  internal/modules/addon.lua
- Size 578B
- SHA256 e761e650dd22a2c6f06727582831ef7e55d4156b0ee7d01a0b33ef27edafeaa0
- MD5 39e503dd38ef48118917b8cdadfb45c9
- SHA1 5d4c05beb6f8f218b7d671a2992b2813438096cf
- SHA512 99a990a16c594aac87ae3bda0f389c2c51b5deb6ae43daea73a87843a9d360ceedb540dc0c6402792fa5b0f6c53b2dc4c749455f4b41136ac7a242c8d8a0ddde
- MD5 SHA1 SHA512
Score

3^/10
behavioral28
- Target
  internal/modules/console/default_commands.lua
- Size 965B
- SHA256 601fb9032175795ad5846a60403a2e8d09c5dc5435994ea5dbc640b19e169f24
- MD5 782a2e5a14ada36950392cc62157cd1a
- SHA1 bca484a58b7a37f2ebd0ac2789476771ce64d60a
- SHA512 f4006506b6830f0eb8a650b4f6772d03de379eb75321ac4adef319d82cb4ace30663f1d12bba9de70c260b4439a61d68db28cbb7dee963a6e096006a49fa09b8
- MD5 SHA1 SHA512
Score

3^/10
behavioral29
- Target
  internal/modules/scripthookv.lua
- Size 753B
- SHA256 1b078d48ab905172e7ca11291d73d6303905a82029fd26a493b3edd024127da9
- MD5 0842493590edf87c079e3088e83ddea5
- SHA1 f2170d97fa6a36c9e338c75f5880f232e21f4533
- SHA512 c9e16d9fa31c27200994dc154b22a93d9d84ef0ffb2e78932f2d06dc2a79cdef3514ee5e17c3b42184c3294aee0d92eaccbaf311100defc76a45ce39574cb31b
- MD5 SHA1 SHA512
Score

3^/10
behavioral30
- Target
  main_functions.lua
- Size 140KB
- SHA256 2cbc7c7e7b0806467acf077c8476c09e01cfded768969f5784c8ec382656505c
- MD5 a73840d1ea3eef174f8df5ee41ec31fd
- SHA1 287aee0d2d10f6172c26af2e0f154bd2a6cb0fba
- SHA512 c74b1be2e96c69f35a827bbcab0645ada0cacd07f4bda0a0dc896000cfb67f6b59b82bf2428fae38804c886cd8dbdbbff42e9ec1fe1ade648389cf2f96b87197
- SSDEEP 3072:cGVI0FqWdEC7Q7FyUCUR34oiE1+Qa+Q77ETSw+SSqh3l36y:cBVFyUCUR34oiE1+Qa+Q3Ejh3l3b
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral31
- Target
  natives.ini
- Size 213KB
- SHA256 8b20f6fd19009089bf295e6a60bd03f63320abbf7ed262865b95f507576a76a8
- MD5 06fcd6f261866743ab9497f7c8a9567c
- SHA1 fb065df9a6b79ac19da443e2e6aea1f5bed809b6
- SHA512 1d03cec66dc0f9171f5b10a4179a0c3fc5007047e5e98c029ae8093ff16400a370146b734902d163643ac98aab48c60443cd02e5e8149eb94e40ebcb95f377cc
- SSDEEP 6144:C1zRivatBTTOitaP/LW27TMm3dXSDCMlh:/ooitkLW27TMm3d8C6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Gurcu family

Gurcu, WhiteSnake

RedLine

RedLine payload

Redline family

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32