Extracted

• • Target

    89ecd4d3608b88b795626091ab8e31b64009b32223b8cbc0120afb0b2005e528

  • Size

    288KB

  • MD5

    d5c07326071e34b28ce94e867f11e03d

  • SHA1

    e9ea832b7a9eb3078b703bbba9d9be31b0378d17

  • SHA256

    89ecd4d3608b88b795626091ab8e31b64009b32223b8cbc0120afb0b2005e528

  • SHA512

    ad1a7a19fe727ca22f6dee9e3ed39bb8b1a7c253e463e0e85c4d23dfb50883dc599091a132a396f1144abf563b8cea6b255eb1d31996e59f99e1a94346f8c4b3

  • SSDEEP

    6144:1ahO+wRfiRqJiU5c5r3K4UdIS5+MxcRFxEWBXnSCSWZpr:1iXMfiRqJij13KHdzXxcTzSCSS

  Score

  10^/10

  purecrypterdiscoverydownloaderloaderpersistencespywarestealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1