Behavioral task
behavioral1
Sample
6570e239d47518afaf8baeed1da31b475ec07ee1256e85bd0318d397f40d4e5c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6570e239d47518afaf8baeed1da31b475ec07ee1256e85bd0318d397f40d4e5c.exe
Resource
win10v2004-20240226-en
General
-
Target
192b27fa258eb8bb2bfed3fc54566c704c5a96d63088d58f9e548643da9dc280
-
Size
28KB
-
MD5
f8b0e2b7e0a2f94eed48f5584229a66b
-
SHA1
0eeb06b217efed7883184d6016f4fa7a91924255
-
SHA256
192b27fa258eb8bb2bfed3fc54566c704c5a96d63088d58f9e548643da9dc280
-
SHA512
b59f7631c1c994015a9a322dbc78126911424c8cbc7ec36f4f389dcb8e93b8cb533852b27113917286aa44b610df2ff55301b73da97db82224982536a202842b
-
SSDEEP
384:pEdSNtbZaCnAmVPP4n4pgd5w7T/OZuy5aBJSF3FuhAaQ0mZW6riOHSk8/65bqqfY:7Pru4qd5sbOZ8SF3MhYW6mOii5b7dmm6
Malware Config
Signatures
-
PureLog Stealer payload 1 IoCs
resource yara_rule static1/unpack001/6570e239d47518afaf8baeed1da31b475ec07ee1256e85bd0318d397f40d4e5c.exe family_purelog_stealer -
Purelogstealer family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6570e239d47518afaf8baeed1da31b475ec07ee1256e85bd0318d397f40d4e5c.exe
Files
-
192b27fa258eb8bb2bfed3fc54566c704c5a96d63088d58f9e548643da9dc280.zip
Password: infected
-
6570e239d47518afaf8baeed1da31b475ec07ee1256e85bd0318d397f40d4e5c.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ