Extracted

• • Target

    a6d6cfb6bb98d96dc1fdc43def2fbb847d416bce908c4d68790d50fac9a986e3

  • Size

    482KB

  • MD5

    535ddefbc9a7f3bb8decc1705b76d42f

  • SHA1

    73b4d446faa4862fef3623c4f404b26941e9ac6c

  • SHA256

    a6d6cfb6bb98d96dc1fdc43def2fbb847d416bce908c4d68790d50fac9a986e3

  • SHA512

    f0ff010ad37bf3b21a7d038abfe4d2ade41420737f669fbaae0ba9d81e6150a8053383301bca62d5028298eb4167168e0fc5f1d425b8fbeb8a077cd0c65baeea

  • SSDEEP

    6144:uPpJYbryZGXSR/NxwLv1PWNemY2BzOpGZzN28qRdVlZ3VmE:uPpibryAXSR/Nav1WNemYWRaV

  Score

  10^/10

  netwirepurecrypterbotnetdownloaderloaderstealer

  • Detect PureCrypter injector

    loader

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Detects executables packed with SmartAssembly

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2