General

  • Target

    DOC13161720230705091725.EXE

  • Size

    44KB

  • Sample

    230707-h9jl1agh3w

  • MD5

    867251b45427c9c32a767b1fa8fbdd17

  • SHA1

    f3fd541cd69d09b301c7d5c2770d2fab98fb3d36

  • SHA256

    4a61cb1c1eedce4c2c9eed252e2c19497761337b40afaabb7585adfc1d273915

  • SHA512

    26ab8808de16273ea60860337f156e81ac8845aa85ca9748551f628d8e9ec12d127ec4ae0b22fd6e2507597e2b6658e735ecca8b8a11f453ccce30d332950410

  • SSDEEP

    768:tkkPfnjbxZkypwqxStQV81v8lLrEjRU4fXD0kpwY8q:fnnjAydSWV81vuLAjq4fDdpwFq

Malware Config

Extracted

Family

purecrypter

C2

https://mahmoodonline.com/panel/uploads/Ebidr.wav

Targets

    • Target

      DOC13161720230705091725.EXE

    • Size

      44KB

    • MD5

      867251b45427c9c32a767b1fa8fbdd17

    • SHA1

      f3fd541cd69d09b301c7d5c2770d2fab98fb3d36

    • SHA256

      4a61cb1c1eedce4c2c9eed252e2c19497761337b40afaabb7585adfc1d273915

    • SHA512

      26ab8808de16273ea60860337f156e81ac8845aa85ca9748551f628d8e9ec12d127ec4ae0b22fd6e2507597e2b6658e735ecca8b8a11f453ccce30d332950410

    • SSDEEP

      768:tkkPfnjbxZkypwqxStQV81v8lLrEjRU4fXD0kpwY8q:fnnjAydSWV81vuLAjq4fDdpwFq

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks