Extracted

• • Target

    Hogwarts Legacy by Empress.exe

  • Size

    715.8MB

  • MD5

    6697e2951a46bee77fcbd59321c8fc06

  • SHA1

    c8966259d2aa9c216f173f566f3962531b405f10

  • SHA256

    1d3193d3f4806b993f8bf3874f0bfbacfedd860a82ed8b6ab26a9a0d30338a7d

  • SHA512

    fe2be9aeb203bcc81c205e833a1ed9a698cf6edc82053431a34e8d84f2447e9bcaddda11ff4a5b93df7a45ffcd2a6c4f483907f30326d6ce43faf9ee2ffdb1c1

  • SSDEEP

    1536:3rae78zjORCDGwfdCSog013131Zs5gW0MuiNcL3IIG4BLpre1ID1PxY3hBq:dahKyd2n31F253ObL3IIG4xle1IVxGq

  Score

  10^/10

  purecrypterdownloaderloaderpersistencediscoveryspywarestealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2