Extracted

Extracted

• • Target
    https://mega.nz/file/y2gzzDYb#JQaLxiA0teFCssQK0NRwWLJJMsYZDjFers2A-gDz3fM

  Score

  10^/10

  gurcutoxiceyemicrosoftdiscoveryphishingratstealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye

  • Toxiceye family

    toxiceye

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Detected potential entity reuse from brand MICROSOFT.

    phishingmicrosoft

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2