purelogstealer | 0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd[.]zip

General

Target
0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd.zip
Size 2.4MB
Sample240402-l3ftbaec75
SHA256 63e83b22bebb10174f1d1c7577f04f0ebc23198c78c6ea810a163be27b88737c
MD5 b3da740c37fad76f4ecc1c080dafa55a
SHA1 caca9a77719505bcaf7f79627901cfbf4eec5667
SHA512 edd20460e11aab16fe4cbc8fbbe836d4c8b641851f73da50a4ae6d14ad9cc801ae625102164512d262f79ea2832e0ec8cf0a8d27804cac44087f2eac72453c6b
SSDEEP 49152:j1n9kgtb2FcDxADFVRRODGNeQy+heT9DNyHF5DGZ05rxi+tu2fQUzr:hnT2OGD/RRMQyr9DAHyZ05rTl9n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

PureLog Stealer payload 1 IoCs

resource	yara_rule
static1/unpack001/0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd.exe	family_purelog_stealer

Purelogstealer family
purelogstealer

File Explorer

0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd.zip

.zip 2.4MB
0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd.exe

.exe 2.4MB

0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd.zip

SHA256 63e83b22bebb10174f1d1c7577f04f0ebc23198c78c6ea810a163be27b88737c
MD5 b3da740c37fad76f4ecc1c080dafa55a
SHA1 caca9a77719505bcaf7f79627901cfbf4eec5667
SHA512 edd20460e11aab16fe4cbc8fbbe836d4c8b641851f73da50a4ae6d14ad9cc801ae625102164512d262f79ea2832e0ec8cf0a8d27804cac44087f2eac72453c6b
SSDEEP 49152:j1n9kgtb2FcDxADFVRRODGNeQy+heT9DNyHF5DGZ05rxi+tu2fQUzr:hnT2OGD/RRMQyr9DAHyZ05rTl9n
MD5 SHA1 SHA512 SSDEEP

Password

infected

0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd
MD5 6adf971492254cf2a5f8894c8a0d637f
SHA1 009a265a5dc2c1fb960c4cffde17d95fc21fa16d
SHA512 e3455f81e1c8f8aed6e314319b67eea695f6bfc881dacf7703f4f7c9ee11fa60fca77b5ec185f5c383b4ebec5b03c7d235724c2be7899304b07ddd2b0cc48f08
SSDEEP 49152:9woLb4RIEWQqv1RUliCZz7BQlHySGp2pamWWO6PHDM6Pgq9OSQBGDi6QU:Co/ScIi83BQhvGp2g6vpPgZwDL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PureLog Stealer payload

Password

infected

PE Signature issue

Digest

0f:1a:ef:99:eb:40:af:f9:4e:38:cf:a0:71:8a:c2:7f:c5:ec:00:0b:cf:1e:b7:ac:9b:ec:55:ba:f4:e2:66:c5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 29, 2024

Minor OS version

0

Major OS version

4

Entry point

2494686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd.zip

0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd.exe

PE Signature issue

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd.zip

0cb284abb63cf61b070bfa0a5250ff536f92907bbf5eec07070b9aeafa4ac2bd.exe

PE Signature issue

mscoree

dotnet