Overview

overview

10

Static

static

f7882ab564...9e.exe

windows7-x64

10

f7882ab564...9e.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7882ab56428fbde316becaebfa0939e

  • Size

    15.1MB

  • Sample

    220723-e234wsccbr

  • MD5

    f7882ab56428fbde316becaebfa0939e

  • SHA1

    579bfdb1f18cdcbb7fcb08d3988bf53dbb1011bb

  • SHA256

    0e75d1b5b9113f26227b5a16dd13b5bcbbb31cddadf7558536227e2599d8e90b

  • SHA512

    cfc33a7edec1eb80d680f3fb3e7d3b187e7eb4401463e24750a597f5d25c29d30bbefaf5338e6c13fa21001796e737c7212c6339eb0d4de149659abb0fe051f6

Score
10/10
purecrypterloaderpersistencetrojan

Malware Config

Targets

    • Target

      f7882ab56428fbde316becaebfa0939e

    • Size

      15.1MB

    • MD5

      f7882ab56428fbde316becaebfa0939e

    • SHA1

      579bfdb1f18cdcbb7fcb08d3988bf53dbb1011bb

    • SHA256

      0e75d1b5b9113f26227b5a16dd13b5bcbbb31cddadf7558536227e2599d8e90b

    • SHA512

      cfc33a7edec1eb80d680f3fb3e7d3b187e7eb4401463e24750a597f5d25c29d30bbefaf5338e6c13fa21001796e737c7212c6339eb0d4de149659abb0fe051f6

    Score
    10/10
    purecrypterloaderpersistencetrojan

    • Detect PureCrypter loader

      loader

    • PureCrypter

      PureCrypter is a loader which is intended for downloading and executing additional payloads.

      trojanloaderpurecrypter

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks