Extracted

• • Target

    CRM_chat/CRM_chat_laucnher.exe

  • Size

    677.7MB

  • MD5

    e0e15d15df5f199a4a598179ef38efc4

  • SHA1

    c8f9954db05274eb0efc97a9bc6d062abba4bbbe

  • SHA256

    8a1e48fb5bdf53c3ad86c7c2adaacfce682c6088b00af99558601e7cd1e08766

  • SHA512

    59f03df492b6b93ecf97361e34eeae6f17e25dc3cc348667a72c87e56e65bebb1fbd6a20c7c9fc92e6f30bd73ecae3f5b71c8884837785208d54d8c13600d56b

  • SSDEEP

    1536:Krae78zjORCDGwfdCSog01313Vs5gChkD7OMYVG:CahKyd2n31S5veOK

  Score

  10^/10

  purecrypterdownloaderloaderpersistence

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1