Extracted

• • Target
    sub_1478772a2208.bin
  • Size 4.8MB
  • SHA256 1478772a2208da0b42fd08d2e4f3506259d09c50b5af093471d6c874bf19b399
  • MD5 98512fdc1d3b34e2196ca5b34e14f29c
  • SHA1 460f2bbed2bc7419c1664d7f8a9e284e5b9bea83
  • SHA512 ba83759ab4a14007c8344fa665329898d520f640cfab6ec7b177b191f423aa9ec9d07577d64fe11d3cbf56be1744f2e66c1fd0c8a6529fd867377e62445cd6a0
  • SSDEEP 3072:patWqvozZqlXS99bMRfCh+T5bOCYEu05ukO3JJ:pMWqcIXS99bMZ5sCYE7O3P
  • TLSH
    T1F6363A96B2509FB1C59E8D7B81B2473147705E628E42FF012DC7F54A29E32C5EB036AE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutiongurcupersistenceprivilege_escalationspywarestealer

  • Family: Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2