purelogstealer | f6a8b58d0d8447fa707d64edf96eb3c7eae9e3a6fc7fc882ea2f246493e9ec31

General

Target
f6a8b58d0d8447fa707d64edf96eb3c7eae9e3a6fc7fc882ea2f246493e9ec31
Size 2.9MB
Sample240318-cdyhdsdf86
SHA256 f6a8b58d0d8447fa707d64edf96eb3c7eae9e3a6fc7fc882ea2f246493e9ec31
MD5 2af69129233a758c69f90af376b77f22
SHA1 4780be117f3d9c1943d44d16b4d78d8e771480b0
SHA512 b59f4d4f428aa9a3f3d7bbe4753f53a3928eb5d06a5a632a144f21fdfaf2255b19316fda3f1f4440c7d88352321ce486307de110307f4db8200f279ed643a881
SSDEEP 49152:mzW4BO4dQiABX3FVhgrNa7H0ZciVnzdgxMy9oaExU8iIfvswVdNeNHzy/G9ssy2:4js4dQi0X3FDgc72VnhHynxTpwDNehy8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

PureLog Stealer payload 1 IoCs

resource	yara_rule
static1/unpack001/NEW ORDER.pif	family_purelog_stealer

Purelogstealer family
purelogstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/NEW ORDER.pif

File Explorer

f6a8b58d0d8447fa707d64edf96eb3c7eae9e3a6fc7fc882ea2f246493e9ec31

.zip 2.9MB
NEW ORDER.pif

.exe 2.9MB

f6a8b58d0d8447fa707d64edf96eb3c7eae9e3a6fc7fc882ea2f246493e9ec31

SHA256 f6a8b58d0d8447fa707d64edf96eb3c7eae9e3a6fc7fc882ea2f246493e9ec31
MD5 2af69129233a758c69f90af376b77f22
SHA1 4780be117f3d9c1943d44d16b4d78d8e771480b0
SHA512 b59f4d4f428aa9a3f3d7bbe4753f53a3928eb5d06a5a632a144f21fdfaf2255b19316fda3f1f4440c7d88352321ce486307de110307f4db8200f279ed643a881
SSDEEP 49152:mzW4BO4dQiABX3FVhgrNa7H0ZciVnzdgxMy9oaExU8iIfvswVdNeNHzy/G9ssy2:4js4dQi0X3FDgc72VnhHynxTpwDNehy8
MD5 SHA1 SHA512 SSDEEP

NEW ORDER.pif

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 88670303d986c2ab42c91bf120273ceb7df2754708fc871820ca084e1678f670
MD5 fdf78fc377c3344eed18f78d7bb9563e
SHA1 110e53a7d33151433e31e5124debc11d91aa5e4f
SHA512 10cadaa7d927f3ec4502ea140498d8025ce5d48b5d052e014c4a80854045da526a3ec621f421a73e6700175dbdbc6b549f8a98a833f112147bccb0394b5c3f7d
SSDEEP 49152:5k29QKZE+YNvZfzj8jDa9HEZUGVdljgxaG9YSy7+wiiLhKCVHtojtXcbQlG0:51aKZE+ovZf/869KVdF5GlD3ZCxtoJc6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PureLog Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3047758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

f6a8b58d0d8447fa707d64edf96eb3c7eae9e3a6fc7fc882ea2f246493e9ec31

NEW ORDER.pif

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

f6a8b58d0d8447fa707d64edf96eb3c7eae9e3a6fc7fc882ea2f246493e9ec31

NEW ORDER.pif

mscoree

dotnet