gurcu | sub_7cba781d5691[.]bin

General

Target
sub_7cba781d5691.bin
Size 154KB
Sample260524-bzassahs3x
SHA256 7cba781d569196e89a86f10cee7d69918fe05df1461d1f0ed3426ccb2046002e
MD5 c426f46f2c074eda8c903f9868be046d
SHA1 d0352482370beff107eb2b2f13e2de275fbc91c7
SHA512 97eed1bad31bd2e558d2cf6ff3c3026d828f561e2d1439f0daca420f53a3c6b1d59442f043357be9a33761a8e99ac935d08239d2e50811d47909cec8caad7c05
SSDEEP 3072:d0Elo8nshOJIlE+/sY3I9bf4gDJVYRhYKdDrQOu:dPlo8sh8+EY3I9bfdDbcyO
TLSH
T1F5F3F95BB2409FA4D15E8E72A1B213314360D9079E81BF4A5D9BE4D02DD32C6AB136FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer gurcu

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7720988404:AAHJ1d0so4FzXOrfQavDsW60uUFev7BQSjU/sendMessage?chat_id=1660795749
http://147.124.221.201:8080
http://209.38.221.184:8080
http://46.235.26.83:8080
http://147.28.185.29:80
http://206.166.251.4:8080
http://51.159.4.50:8080
http://167.235.70.96:8080
http://194.164.198.113:8080
http://132.145.17.167:9090
https://5.196.181.135:443
http://116.202.101.219:8080
https://185.217.98.121:443
http://185.217.98.121:8080
http://159.203.174.113:8090
http://107.161.20.142:8080
https://192.99.196.191:443
http://65.49.205.24:8080
https://154.9.207.142:443
http://67.230.176.97:8080
http://8.222.143.111:8080
http://8.219.110.16:9999
http://41.87.207.180:9090
http://38.207.174.88:8080
http://185.217.98.121:80
http://18.228.80.130:80
http://168.138.211.88:8099
http://129.151.109.160:8080
http://20.78.55.47:8080
http://8.216.92.21:8080
https://138.2.92.67:443
http://38.60.191.38:80
http://101.126.19.171:80
http://47.96.78.224:8080
http://101.43.160.136:8080

Signatures

Family: Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
stealer gurcu

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sub_7cba781d5691.bin

File Explorer

sub_7cba781d5691.bin

.exe 154KB

sub_7cba781d5691.bin

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7cba781d569196e89a86f10cee7d69918fe05df1461d1f0ed3426ccb2046002e
MD5 c426f46f2c074eda8c903f9868be046d
SHA1 d0352482370beff107eb2b2f13e2de275fbc91c7
SHA512 97eed1bad31bd2e558d2cf6ff3c3026d828f561e2d1439f0daca420f53a3c6b1d59442f043357be9a33761a8e99ac935d08239d2e50811d47909cec8caad7c05
SSDEEP 3072:d0Elo8nshOJIlE+/sY3I9bf4gDJVYRhYKdDrQOu:dPlo8sh8+EY3I9bfdDbcyO
TLSH
T1F5F3F95BB2409FA4D15E8E72A1B213314360D9079E81BF4A5D9BE4D02DD32C6AB136FF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

162910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sub_7cba781d5691.bin

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

sub_7cba781d5691.bin

mscoree

dotnet