purelogstealer | 3c5ad97151d2804bc535042bffa9d864b6b6cd4cdbe2f3c15e0736b8aec96a45[.]zip

General

Target
3c5ad97151d2804bc535042bffa9d864b6b6cd4cdbe2f3c15e0736b8aec96a45.zip
Size 29KB
Sample240503-bndqasbd8s
SHA256 3c5ad97151d2804bc535042bffa9d864b6b6cd4cdbe2f3c15e0736b8aec96a45
MD5 ae1c5c3de412e8de3efd47987c488f8e
SHA1 4709fd16f124cca8354dcb1e38ec05e9a42dcc7d
SHA512 f0ff2059bbce23622087d8d55cbe0fe907b58796cdc303f42e93e36bd2cb3faff2a361c210ddeba29c99804c96f5cde8691d0104cc3dc2dfefd766f75549f2a7
SSDEEP 768:ijjeP08bT4KmhMa0uEKAbYBRWHzSQviaJTcKZhWmCTB48:rP08bER0u1WeQ1ZV4BP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

PureLog Stealer payload 1 IoCs

resource	yara_rule
static1/unpack002/Jkxkt.exe	family_purelog_stealer

Purelogstealer family
purelogstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Jkxkt.exe

File Explorer

3c5ad97151d2804bc535042bffa9d864b6b6cd4cdbe2f3c15e0736b8aec96a45.zip

.zip 29KB
NEW ENQUIRY 042400.img

.iso 102KB
Jkxkt.exe

.exe 50KB

3c5ad97151d2804bc535042bffa9d864b6b6cd4cdbe2f3c15e0736b8aec96a45.zip

SHA256 3c5ad97151d2804bc535042bffa9d864b6b6cd4cdbe2f3c15e0736b8aec96a45
MD5 ae1c5c3de412e8de3efd47987c488f8e
SHA1 4709fd16f124cca8354dcb1e38ec05e9a42dcc7d
SHA512 f0ff2059bbce23622087d8d55cbe0fe907b58796cdc303f42e93e36bd2cb3faff2a361c210ddeba29c99804c96f5cde8691d0104cc3dc2dfefd766f75549f2a7
SSDEEP 768:ijjeP08bT4KmhMa0uEKAbYBRWHzSQviaJTcKZhWmCTB48:rP08bER0u1WeQ1ZV4BP
MD5 SHA1 SHA512 SSDEEP

Jkxkt.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 888027b5448274a11bd0e967005ad0100aa1c137776c292d52fff8a3a713c2ec
MD5 0f271d188d1e3c4fdbf194aa075b08d4
SHA1 3b2ac45083f47c1f85ffa1465fd7ad4fd83b661c
SHA512 fd781dd49eedfa71f4f656b8da183e9c2a54752247a052408d0c79012eb8a6a9e13c58eec39b856637b7ee5c1f3a38036cfe9b848c40bfccf3df412f464c76cb
SSDEEP 1536:4bbKjYiHtMYiGfcYmI4xb7GEepmAoAPx:9EiNWGfBst7cmRq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PureLog Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

57262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

3c5ad97151d2804bc535042bffa9d864b6b6cd4cdbe2f3c15e0736b8aec96a45.zip

NEW ENQUIRY 042400.img

Jkxkt.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

3c5ad97151d2804bc535042bffa9d864b6b6cd4cdbe2f3c15e0736b8aec96a45.zip

NEW ENQUIRY 042400.img

Jkxkt.exe

mscoree

dotnet