purelogs | 7F837BEBEE96BF3FF49561B9300C10466BF1CA891EF4A18BE35CD56146B040E4

General

Target
7F837BEBEE96BF3FF49561B9300C10466BF1CA891EF4A18BE35CD56146B040E4
Size 547KB
Sample231206-epg1wsba53
SHA256 7f837bebee96bf3ff49561b9300c10466bf1ca891ef4a18be35cd56146b040e4
MD5 8852d2e38d5c9b70da09f56903cec81a
SHA1 482b795078bed7423e0312ccec7036732355da94
SHA512 88206e11e8b95605e65d1f6afce2ec21c262aa569a9ccce78f3bde579509dee38bfec5875c9e83063b58f3050808badffb08a648cc9462b7f68efdb0b0c70ca1
SSDEEP 12288:UT1ry5BBonVxTvXQMWDf1nYZH3Ob+LlfyVbi1wZkskPene:Uk5BBqPQMWzGZHK+LlfyVbii17e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogs

Malware Config

Signatures

Detect PureLogs payload 1 IoCs

resource	yara_rule
static1/unpack002/Rybkdr.exe	family_purelogs

Purelogs family
purelogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Rybkdr.exe

File Explorer

7F837BEBEE96BF3FF49561B9300C10466BF1CA891EF4A18BE35CD56146B040E4

.rar 547KB
ORDER FUZETEC PO2311-000031.img

.iso 1.2MB
Rybkdr.exe

.exe 1.1MB

7F837BEBEE96BF3FF49561B9300C10466BF1CA891EF4A18BE35CD56146B040E4

SHA256 7f837bebee96bf3ff49561b9300c10466bf1ca891ef4a18be35cd56146b040e4
MD5 8852d2e38d5c9b70da09f56903cec81a
SHA1 482b795078bed7423e0312ccec7036732355da94
SHA512 88206e11e8b95605e65d1f6afce2ec21c262aa569a9ccce78f3bde579509dee38bfec5875c9e83063b58f3050808badffb08a648cc9462b7f68efdb0b0c70ca1
SSDEEP 12288:UT1ry5BBonVxTvXQMWDf1nYZH3Ob+LlfyVbi1wZkskPene:Uk5BBqPQMWzGZHK+LlfyVbii17e
MD5 SHA1 SHA512 SSDEEP

Rybkdr.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 eea977d6c736325a557a0c31552c49c51399748fc138db772735109fb6510757
MD5 d6393631100d7160ca348397cb01943d
SHA1 3ff0803ae9fd31efc74bcb29006c1cbf29b03f75
SHA512 efef9bd64c68757c762a2fdbeb21cc6fc504b85dfd4f468b13504b00b365b58cd83aad3dbbc1cc12c8688d74777d69d6e09685cc9310a0cd29885f6a74fea576
SSDEEP 24576:X1uC5JT92RkNSIXtzdf1ZOS0e42xWVYknV3G/Z:AKfRdtsS0e4GIV3GR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect PureLogs payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1182606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

7F837BEBEE96BF3FF49561B9300C10466BF1CA891EF4A18BE35CD56146B040E4

ORDER FUZETEC PO2311-000031.img

Rybkdr.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

7F837BEBEE96BF3FF49561B9300C10466BF1CA891EF4A18BE35CD56146B040E4

ORDER FUZETEC PO2311-000031.img

Rybkdr.exe

mscoree

dotnet