purelogs | f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45[.]exe[.]zip

General

Target
f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe.zip
Size 2.4MB
Sample231201-snee9sca4w
SHA256 ab046daac6a9c351171be163feb558777b8eb5d10a3b2560e62e6ca0b4ceb8ee
MD5 a288ed6584f6e98fe4720a1f8bd8ee92
SHA1 d8348bc53b83d7c70b784af81aa48c36d1b6d9eb
SHA512 1263b2b52a6f6fa00d7cdb0a2f131ba887c801c5b539e290dc832cbd3fc8b51aa13c9c1d50bc173c164ece087ae06e364a607be14d1b63af8131599b4d132cbf
SSDEEP 49152:ZJ+AKvY0/fU+k4DaLdsCWnvjJf7PjY1NSuoL81L8mYdxdl7QhywMAI:ZJoYq8+krLlW1b0uZL81akUwMAI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogs

Malware Config

Signatures

Detect PureLogs payload 1 IoCs

resource	yara_rule
static1/unpack001/f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe	family_purelogs

Purelogs family
purelogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe

File Explorer

f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe.zip

.zip 2.4MB
f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe

.exe 6.4MB

f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe.zip

SHA256 ab046daac6a9c351171be163feb558777b8eb5d10a3b2560e62e6ca0b4ceb8ee
MD5 a288ed6584f6e98fe4720a1f8bd8ee92
SHA1 d8348bc53b83d7c70b784af81aa48c36d1b6d9eb
SHA512 1263b2b52a6f6fa00d7cdb0a2f131ba887c801c5b539e290dc832cbd3fc8b51aa13c9c1d50bc173c164ece087ae06e364a607be14d1b63af8131599b4d132cbf
SSDEEP 49152:ZJ+AKvY0/fU+k4DaLdsCWnvjJf7PjY1NSuoL81L8mYdxdl7QhywMAI:ZJoYq8+krLlW1b0uZL81akUwMAI
MD5 SHA1 SHA512 SSDEEP

Password

infected

f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45
MD5 401f8656ddd0667be93d82710ce4f027
SHA1 6e7bd620f83fda61d99586fd64d8f3248a31d058
SHA512 6e250d5fc40888066d12ef261ad247e8845c07e00a8f28cb2abf9664172e27bf06153344cfdd07c73663898cf104c8207988ef9271947d1a30084700bf3155ef
SSDEEP 196608:K9lOSvoLnXZ+sLsMC0sQqpz5/l7c/g933N6b9:K9lOSvoLnXZ+sLsMC0sQqpz5/l78g4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect PureLogs payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6695934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe.zip

f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe.zip

f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe

mscoree

dotnet