purelogstealer | 731adf7ac51c45d16b4eabb8a2cba5789498f52e355cbe278cb54172ecc884f2

General

Target
731adf7ac51c45d16b4eabb8a2cba5789498f52e355cbe278cb54172ecc884f2
Size 500KB
Sample240322-cpxegafb44
SHA256 731adf7ac51c45d16b4eabb8a2cba5789498f52e355cbe278cb54172ecc884f2
MD5 e50c647ade760bb34458f4a23458da14
SHA1 cc1f2cebabc8fb3208818b2028b18b0040e2c229
SHA512 01b4dc95023981513e8912b37c5ba5aa6b9c232c8c80dbd50e6930c9b9a334a9ea3c09b87c978a22c18f1251488e32b639780d5f749b1067cfab11f29319c5c3
SSDEEP 3072:/S6MBoglFU8uT14K5BjWUzpsYyjxh4H444lM:/8BoO+T4KOO6f4H444l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

PureLog Stealer payload 2 IoCs

resource	yara_rule
sample	family_purelog_stealer
static1/unpack002/1C24TNN_00000014.exe	family_purelog_stealer

Purelogstealer family
purelogstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/1C24TNN_00000014.exe

File Explorer

731adf7ac51c45d16b4eabb8a2cba5789498f52e355cbe278cb54172ecc884f2

.iso 500KB
out.iso

.iso 500KB
1C24TNN_00000014.exe

.exe 448KB

731adf7ac51c45d16b4eabb8a2cba5789498f52e355cbe278cb54172ecc884f2

SHA256 731adf7ac51c45d16b4eabb8a2cba5789498f52e355cbe278cb54172ecc884f2
MD5 e50c647ade760bb34458f4a23458da14
SHA1 cc1f2cebabc8fb3208818b2028b18b0040e2c229
SHA512 01b4dc95023981513e8912b37c5ba5aa6b9c232c8c80dbd50e6930c9b9a334a9ea3c09b87c978a22c18f1251488e32b639780d5f749b1067cfab11f29319c5c3
SSDEEP 3072:/S6MBoglFU8uT14K5BjWUzpsYyjxh4H444lM:/8BoO+T4KOO6f4H444l
MD5 SHA1 SHA512 SSDEEP

PureLog Stealer payload

1C24TNN_00000014.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9153a8b3b10c014b57d836be98255e8747f3ee4d933c8ed1980cde09d5dec0e9
MD5 241036b62b644433eeda9f4bf4c8dc40
SHA1 57e00fd86695049639168c22fb5bb9ab9136a7fe
SHA512 28097d26167483c9dc57230875bd551985278fb452ba74e7e0914ddb9c3894ff27e7cf088b6b2cdbb2054a52001c540c3c89119b010e9f3201ec4e284b96dae1
SSDEEP 3072:HS6MBoglFU8uT14K5BjWUzpsYyjxh4H444lM:H8BoO+T4KOO6f4H444l
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PureLog Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

94046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

731adf7ac51c45d16b4eabb8a2cba5789498f52e355cbe278cb54172ecc884f2

out.iso

1C24TNN_00000014.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

731adf7ac51c45d16b4eabb8a2cba5789498f52e355cbe278cb54172ecc884f2

out.iso

1C24TNN_00000014.exe

mscoree

dotnet