Extracted

• • Target

    new order.exe

  • Size

    6KB

  • MD5

    805f8568083e83c0955f88e76d662d09

  • SHA1

    2b9fb2c42f4b2ca7210c7aadb1363a475355642b

  • SHA256

    713d9f0f4cda96491b1d757e354b08756fc2f67f2cc039b38566c9bb48f23f16

  • SHA512

    10ea6e19f5f93a11c720c9d3f88115402454d6bd01ade0a789d532e5a9e80c9eb9bf47ea1d830661b79c6fc168cabb670677ba18321fe3b6fa94c5d727a116f0

  • SSDEEP

    96:pntK+KmXi5aB+tFLbd58xd2nKFRa08rQzNt:hnby5q+tVd58AmZIy

  Score

  10^/10

  purecryptercollectiondownloaderloaderpersistencespywarestealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2