General
-
Target
4385abb8f1ffbb6ad3953295892730b8.bin
-
Size
1016KB
-
Sample
230127-qakzsaba96
-
MD5
e51ab9864c3f109d90606352f91657da
-
SHA1
8b61358f03f4fe9a628abcbad8ba88e5b0064d15
-
SHA256
8444417a982493f6d797f0f6af3b4070baa21fef8be0b68afc9cb47d4a493841
-
SHA512
b64193e7732f4ba4ead4d3635ad11d937a4235995bb78d43ecd8fad2c3697ef606046930fcba76b50bc4d68c6f8d260a5b03ed6f211d59c81ce031ca47dda0cd
-
SSDEEP
24576:rYQ2qm5V/C/nBhWIqHJccXjxorC0GHECWfRy4p/Sf:rYRqIeHHcTOz6ERJJp/Sf
Static task
static1
Behavioral task
behavioral1
Sample
cf496576e970c84e62e2e66d2c7d27339914d32087e9877aa4fe2cd2bf21255e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cf496576e970c84e62e2e66d2c7d27339914d32087e9877aa4fe2cd2bf21255e.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
cf496576e970c84e62e2e66d2c7d27339914d32087e9877aa4fe2cd2bf21255e.exe
-
Size
1018KB
-
MD5
4385abb8f1ffbb6ad3953295892730b8
-
SHA1
34c74d4ee9850a36e746747022756834fdaa518a
-
SHA256
cf496576e970c84e62e2e66d2c7d27339914d32087e9877aa4fe2cd2bf21255e
-
SHA512
1cc2fdccc302aad4b5a4668bca85043d45871c702811765946e76c3dca10c15c5b4598318e0d383d4e8db4dbe36d2e448978367ebe329268ab699c00e11da3d3
-
SSDEEP
24576:ik+b1V8TTyGainaKNH+TH3tPIhcvz+HQei8RtDUr:qfK2inbp+BPG4KweLjDU
-
Detect PureCrypter injector
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-