Overview

overview

10

Static

static

1

Web_Razer_...41.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Web_Razer_Synapse_Installer_v2.21.24.41.exe

  • Size

    25.6MB

  • Sample

    231202-q5jefadc3s

  • MD5

    2d73b9c85866634de78eb9f833fc50dc

  • SHA1

    1a2ca691d2f53ced41d0d11973de8fb583cb1113

  • SHA256

    cc8afa3fb773dc68840e7d4b3423ae47e19a12bfceeadc332cddec9d1d545627

  • SHA512

    df366ba42008b7abf595c1f6d1c48b8edcefc5abc73bbf88c410134b223353a8dc1caf46a121df925e5f8ff7fb3828891773e7e1227c9097960cb5ab904067ba

  • SSDEEP

    786432:JCMvNyeof/jP+KhRNmMogeINr0hJMPULu:JCMkewbP+8lD/cy

Score
10/10
purelogsdiscoverypersistencestealer

Malware Config

Targets

    • Target

      Web_Razer_Synapse_Installer_v2.21.24.41.exe

    • Size

      25.6MB

    • MD5

      2d73b9c85866634de78eb9f833fc50dc

    • SHA1

      1a2ca691d2f53ced41d0d11973de8fb583cb1113

    • SHA256

      cc8afa3fb773dc68840e7d4b3423ae47e19a12bfceeadc332cddec9d1d545627

    • SHA512

      df366ba42008b7abf595c1f6d1c48b8edcefc5abc73bbf88c410134b223353a8dc1caf46a121df925e5f8ff7fb3828891773e7e1227c9097960cb5ab904067ba

    • SSDEEP

      786432:JCMvNyeof/jP+KhRNmMogeINr0hJMPULu:JCMkewbP+8lD/cy

    Score
    10/10
    purelogsdiscoverypersistencestealer

    • Detect PureLogs payload

    • PureLogs

      PureLogs is an infostealer written in C#.

      stealerpurelogs

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks