General

  • Target

    23ee744fa24aaada6ab0a81166c2f5466d29d502

  • Size

    477KB

  • Sample

    230127-h3aerahc38

  • MD5

    447f1d5a645314beb0b1d6b0f2f5119f

  • SHA1

    23ee744fa24aaada6ab0a81166c2f5466d29d502

  • SHA256

    850f818aca36188fff35a492275cd63ba81f6e48263faa669fb5e192165f2f92

  • SHA512

    2a4ed5f9a933ef0330c81672c17623143ee0c3693d6c56c85632c0bac2b7a8fb049bae0af904a1bd2a16db8ac338d78d0928e0edc7f5d866170d25c19407e752

  • SSDEEP

    3072:N36LY3qIwBzFyIR+DSbhsR2OsHas+8yqB1LuiCx8V8rIiJzQvstptE8z0N:N36hWsHtlLv8EiFES0

Malware Config

Targets

    • Target

      23ee744fa24aaada6ab0a81166c2f5466d29d502

    • Size

      477KB

    • MD5

      447f1d5a645314beb0b1d6b0f2f5119f

    • SHA1

      23ee744fa24aaada6ab0a81166c2f5466d29d502

    • SHA256

      850f818aca36188fff35a492275cd63ba81f6e48263faa669fb5e192165f2f92

    • SHA512

      2a4ed5f9a933ef0330c81672c17623143ee0c3693d6c56c85632c0bac2b7a8fb049bae0af904a1bd2a16db8ac338d78d0928e0edc7f5d866170d25c19407e752

    • SSDEEP

      3072:N36LY3qIwBzFyIR+DSbhsR2OsHas+8yqB1LuiCx8V8rIiJzQvstptE8z0N:N36hWsHtlLv8EiFES0

    • Detect PureCrypter injector

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks