Extracted

• • Target

    Ejpba.exe

  • Size

    6KB

  • MD5

    1c56623199e1959f271a191d603360bf

  • SHA1

    9a7429e8b08ef843739c7739e8a314006c20b2af

  • SHA256

    99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a

  • SHA512

    87c50fb8f13d5b0ce5d83d99e64a7728e466e33118faea4c52136dd8a2f70d5f4217c90f4cc3c415628b9f96b7ed114cedb2455e3edc1cc39e67a36b79fceee4

  • SSDEEP

    96:QhN/c/kk91xUL9678Ms0wFFpBV4Xh4yvn1j4r/8iT85fTc70zNt:QhN/cx1o96hwFH4R4viRM+

  Score

  10^/10

  purecryptercollectiondownloaderloaderpersistencespywarestealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2