gurcu | a7f8482b67e7000865195612c9a3028d0be97af52b4360f784054d5444b0b943

General

Target

XWorm RAT V2.1.rar
Size

32.3MB
Sample

250101-dmex3svmcj
MD5

462d28c33afdd9482d7d10c08febf615
SHA1

04c8a9698de4abea97af69506f5fbdc093539b1a
SHA256

a7f8482b67e7000865195612c9a3028d0be97af52b4360f784054d5444b0b943
SHA512

f047c53c206dae5de7e09d2b3a1dfb169f1bcb2e5a075dbff82c5b8d21c5363cad4cd81b4a3bab61e551c21f6b4e930237639c0b1aaa44da608f93975dbec099
SSDEEP

786432:+LLnQRIjMRfdFZkRNlCVdICz0NMb7X+OwTPntsHx9RiPHQL+Wly:AkhXFZM2VOKDCkxSOA

Score

10^/10

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=-1002258988684&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendMessage?chat_id=-1002258988684

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/getUpdates?offset=-

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=-1002258988684&caption=%F0%9F%93%B8Screenshot%20take

Targets

- Target
  
  XWorm RAT V2.1.rar
- Size
  
  32.3MB
- MD5
  
  462d28c33afdd9482d7d10c08febf615
- SHA1
  
  04c8a9698de4abea97af69506f5fbdc093539b1a
- SHA256
  
  a7f8482b67e7000865195612c9a3028d0be97af52b4360f784054d5444b0b943
- SHA512
  
  f047c53c206dae5de7e09d2b3a1dfb169f1bcb2e5a075dbff82c5b8d21c5363cad4cd81b4a3bab61e551c21f6b4e930237639c0b1aaa44da608f93975dbec099
- SSDEEP
  
  786432:+LLnQRIjMRfdFZkRNlCVdICz0NMb7X+OwTPntsHx9RiPHQL+Wly:AkhXFZM2VOKDCkxSOA
Score

10^/10

gurcu discovery persistence spyware stealer
- Gurcu family
  gurcu
- Gurcu, WhiteSnake
  Gurcu aka WhiteSnake is a malware stealer written in C#.
  stealer gurcu
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1