shurk | 052e54df0b86483f84bbff6504e202c36e7bc25885e369e830dd7086fb7c7562

Analysis

max time kernel
635s
max time network
650s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
20-12-2023 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030.exe
Size

541KB
MD5

3f4dea6e7b8ccf697d2936176954b390
SHA1

4b34af92af1e22a6ec47ac36dc4b5bb5d743e01d
SHA256

30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030
SHA512

e6d5c74048d2510a9ed8dc253158a1f531d61492832238b1c2f5c7c857da57008af1f8d3cd34d5b3077f307c1d42d61f36fd47e40567323d5cd4552fdc46256d
SSDEEP

12288:jmWfpP7y6eXLpjblm8wrDGXnPD5pIvJwpTrvX2Hn4Zuc374hotEwOu3LE:jmUh+LLpjblm8eDGXnPD5pIRSDXkg8io

Score

10^/10

shurk infostealer spyware stealer

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030.exe

pid process

5836 30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030.exe
5836 30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030.exe

pid	process
5836	30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030.exe
5836	30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030.exe

C:\Users\Admin\AppData\Local\Temp\30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030.exe
"C:\Users\Admin\AppData\Local\Temp\30af8d3ec685a4a5669f1377bb74589772a0428d9daa214c179a795dcf4b9030.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5836

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads