Extracted

• • Target

    4c9a58b8a77a5f4c2e4a5ae070c25238aff20810b81e92393ef955f53e6eb5f3

  • Size

    444KB

  • MD5

    9bec57e55df3a59a8e23e898a205d3b4

  • SHA1

    df0fcd66f33e6d82bd650cee765a5d4010fdd728

  • SHA256

    4c9a58b8a77a5f4c2e4a5ae070c25238aff20810b81e92393ef955f53e6eb5f3

  • SHA512

    cc2aa36adbca5c738f9317b30a12849454dfcc719013db5c488191e7a873598a1287ac1261b22b3a12cbcbad5df9303562c8b0f69949d677fee5fdf26755d8d9

  • SSDEEP

    12288:Dzr11rsCDFL2aCI1i4TtDFO7zXylU3J9OOfuJsA3W/:DzH4AFOi/O7zN3OPe/

  Score

  10^/10

  gurcuexecutionstealer

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Drops file in System32 directory

  behavioral1