purelogs | 6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096[.]img

General

Target
6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096.img
Size 1.2MB
Sample231202-k5pzbsbb43
SHA256 6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096
MD5 f9b1a13cd14eaba6c7e18dd17a2d274c
SHA1 bcecb8013d3fdc4715789eb20e91f2e7fa22fa54
SHA512 b9571e87cab4fe78bc88d22de0e18137a0c315b8dbcaf3d4cd2589272ae31c97e867a20ea6b9f4082c31415692ab26917bfe15222927a20a01188f80b763d83d
SSDEEP 24576:T1uC5JT92RkNSIXtzdf1ZOS0e42xWVYknV3G/Z:8KfRdtsS0e4GIV3GR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogs

Malware Config

Signatures

Detect PureLogs payload 2 IoCs

resource	yara_rule
sample	family_purelogs
static1/unpack001/Rybkdr.exe	family_purelogs

Purelogs family
purelogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Rybkdr.exe

File Explorer

6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096.img

.iso 1.2MB
Rybkdr.exe

.exe 1.1MB

6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096.img

SHA256 6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096
MD5 f9b1a13cd14eaba6c7e18dd17a2d274c
SHA1 bcecb8013d3fdc4715789eb20e91f2e7fa22fa54
SHA512 b9571e87cab4fe78bc88d22de0e18137a0c315b8dbcaf3d4cd2589272ae31c97e867a20ea6b9f4082c31415692ab26917bfe15222927a20a01188f80b763d83d
SSDEEP 24576:T1uC5JT92RkNSIXtzdf1ZOS0e42xWVYknV3G/Z:8KfRdtsS0e4GIV3GR
MD5 SHA1 SHA512 SSDEEP

Detect PureLogs payload

Rybkdr.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 eea977d6c736325a557a0c31552c49c51399748fc138db772735109fb6510757
MD5 d6393631100d7160ca348397cb01943d
SHA1 3ff0803ae9fd31efc74bcb29006c1cbf29b03f75
SHA512 efef9bd64c68757c762a2fdbeb21cc6fc504b85dfd4f468b13504b00b365b58cd83aad3dbbc1cc12c8688d74777d69d6e09685cc9310a0cd29885f6a74fea576
SSDEEP 24576:X1uC5JT92RkNSIXtzdf1ZOS0e42xWVYknV3G/Z:AKfRdtsS0e4GIV3GR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect PureLogs payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1182606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096.img

Rybkdr.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096.img

Rybkdr.exe

mscoree

dotnet