Extracted

• • Target

    Hogwarts Legacy by Empress.exe

  • Size

    326.4MB

  • MD5

    7a1c6ba99ba81106917acf37c8711bac

  • SHA1

    4b08c2a3d26242d209d45f086f001f4b66a6c31a

  • SHA256

    e535bc5f201f84ccd46ecc2374ae4213b46456d8c027d44f58700579018c5264

  • SHA512

    b9a234411630edc3029d62954a874714d911704d92db94a27323dec77c4334187ab1608ebf527b90a8d461254364d82c616dfdd31cf0739ff6f026e04def8686

  • SSDEEP

    1536:3rae78zjORCDGwfdCSog013131Zs5gW0MuiNcL3IIG4BLpr:dahKyd2n31F253ObL3IIG4xl

  Score

  10^/10

  purecrypterdownloaderloaderpersistencediscoveryspywarestealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2