Extracted

• • Target

    INV-0097H.exe

  • Size

    6KB

  • MD5

    4a63e62a75447c399f717fd40805ada8

  • SHA1

    72a8c04321d4547c02464151ff585e5989d04d13

  • SHA256

    f5ee72bc3ed7127fdea098689d11b7c18f9bb5debbab5e4f5b0293b8017692e0

  • SHA512

    28ac8303385ad8888afee696bea516a2bc88dac8a857f67ef6640d7ed0363b596d048f21973dc933e35b9167948ec515a92a68b27e0901cb90aaf1212caff78c

  • SSDEEP

    96:zHdkMfcSBSGjmHCJoFAD4PF9MxM/bRrkQIOLFnU:zH9lkCql99MxMDRAwu

  Score

  10^/10

  purecryptercollectiondownloaderloaderpersistencespywarestealer

  • Detect PureCrypter injector

    loader

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2