Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/I...

windows10-2004-x64

10

Resubmissions

09/01/2025, 19:49

250109-yjtbhs1nck10

09/01/2025, 19:48

250109-yjlaxa1nbq3

09/01/2025, 18:48

250109-xf75tszlcj10

09/01/2025, 18:45

250109-xeef5azkfp10

09/01/2025, 18:34

250109-w7sc1szjak10

09/01/2025, 18:31

250109-w54y2axkf110

03/01/2025, 17:08

250103-vntw3atqdt10

03/01/2025, 15:27

250103-svv2latmgr10

03/01/2025, 15:23

250103-sslp5stlhk10

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://github.com/Intestio/XWorm-RAT/releases/tag/xworm
  • Sample250103-sslp5stlhk
Score
10/10
gurcudiscoverypersistencespywarestealer

Malware Config

Extracted

Family

  • gurcu

C2

  • https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=-1002258988684&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb)%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%84%20-%20BrowserDownloads.txt%20(0.22%20kb

  • https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendMessage?chat_id=-1002258988684

  • https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/getUpdates?offset=-

  • https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=-1002258988684&caption=%F0%9F%93%B8Screenshot%20take

Targets

    • Target
      https://github.com/Intestio/XWorm-RAT/releases/tag/xworm
    Score
    10/10
    gurcudiscoverypersistencespywarestealer

    • Gurcu family

      gurcu

    • Gurcu, WhiteSnake

      Gurcu aka WhiteSnake is a malware stealer written in C#.

      stealergurcu

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks