purelogstealer | 44f5f7e8cc125b74e496bf172333273e0d5530f0acfcfb87986a8ea4b054c59b

General

Target
44f5f7e8cc125b74e496bf172333273e0d5530f0acfcfb87986a8ea4b054c59b
Size 416KB
Sample240329-b87twaed5y
SHA256 44f5f7e8cc125b74e496bf172333273e0d5530f0acfcfb87986a8ea4b054c59b
MD5 fcaf65881fa2f33b24428906c1eb109f
SHA1 0c929c66525d467b5e687ab5a2ce4171d2121b56
SHA512 92f42670e0a3d9a13bd556fb5f089c7b269afb36c4dfb7036aaf264b5a65ee64722139923f13416fac64855e34f5f4cab946cd2b597bc3c37920182166ab3bc6
SSDEEP 6144:GlCXcIbbHRjWje36AmF26qrvuzuzCCdsbXt:GlCXLbHRjW+mcOu7ds
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

PureLog Stealer payload 2 IoCs

resource	yara_rule
sample	family_purelog_stealer
static1/unpack002/Purchase Order_5001535449_ES010_pdf .exe	family_purelog_stealer

Purelogstealer family
purelogstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Purchase Order_5001535449_ES010_pdf .exe

File Explorer

44f5f7e8cc125b74e496bf172333273e0d5530f0acfcfb87986a8ea4b054c59b

.iso 416KB
out.iso

.iso 416KB
Purchase Order_5001535449_ES010_pdf .exe

.exe 355KB

44f5f7e8cc125b74e496bf172333273e0d5530f0acfcfb87986a8ea4b054c59b

SHA256 44f5f7e8cc125b74e496bf172333273e0d5530f0acfcfb87986a8ea4b054c59b
MD5 fcaf65881fa2f33b24428906c1eb109f
SHA1 0c929c66525d467b5e687ab5a2ce4171d2121b56
SHA512 92f42670e0a3d9a13bd556fb5f089c7b269afb36c4dfb7036aaf264b5a65ee64722139923f13416fac64855e34f5f4cab946cd2b597bc3c37920182166ab3bc6
SSDEEP 6144:GlCXcIbbHRjWje36AmF26qrvuzuzCCdsbXt:GlCXLbHRjW+mcOu7ds
MD5 SHA1 SHA512 SSDEEP

PureLog Stealer payload

Purchase Order_5001535449_ES010_pdf .exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 517ee22c4f13794348a1743e39a119c6181b9ce6dff42f7e525fcd9fc2f768d4
MD5 c05d1f30c4e092ea20de16c871eca157
SHA1 5aca67a7f815192a972966ab5400a95cdc2e5ed6
SHA512 055dcc2dfd771600625349a64b572f78777d6e6e9970893b87e9359d4b95c2e3f8ac14cbb11d1892151bc43fb40072b2024c8526c9dbc6c79547873b6d669a0c
SSDEEP 6144:plCXcIbbHRjWje36AmF26qrvuzuzCCdsbXt:plCXLbHRjW+mcOu7ds
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PureLog Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

268798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

44f5f7e8cc125b74e496bf172333273e0d5530f0acfcfb87986a8ea4b054c59b

out.iso

Purchase Order_5001535449_ES010_pdf .exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

44f5f7e8cc125b74e496bf172333273e0d5530f0acfcfb87986a8ea4b054c59b

out.iso

Purchase Order_5001535449_ES010_pdf .exe

mscoree

dotnet