General

  • Target

    Doc000781102.rar

  • Size

    27KB

  • Sample

    240621-pz3qfszfpb

  • MD5

    db8f5cd76145d1be8cdf411ee526b415

  • SHA1

    640c922e27e700833aed9e85044057fb65d38147

  • SHA256

    7e7d19f9ef7c09c8ce8e0faf25256e8a9f9d0506b7737d7244e730fd66dad3f0

  • SHA512

    a6f38adb8af67d5344258b51ba117329c5f70b613550341218a7734dae39b4d164df9c390c83189ce2a0f198b6477c57b8bebe00d9dea2b33c94d8291fcecddc

  • SSDEEP

    384:KW/belVah1490kGmb6YFV5U3HaFShsGbY6KQ2CAAplLT051jaV7AqvKjuNwZ7hJM:nmafUVi3+Si629au3IDvKAO+JCV/7yd

Malware Config

Extracted

Family

purecrypter

C2

http://78.111.67.189/cn/Pffmtfdozq.pdf

Targets

    • Target

      Doc000781102.exe

    • Size

      113KB

    • MD5

      c7e267629511f510ff5e8934ceb2f382

    • SHA1

      814753fa8f15d440e36abd22ce908125ad972730

    • SHA256

      0ca211901a9024dc07ca4973a6fe71813c5d58d468117169820d6ba91ca9f23d

    • SHA512

      be04cca9194d247e665d342c62e0f9d6e26ef596fc09b6ff148b568e54b682265eff366244448745cd85d7af7702bfad4798c281a459cb65025e6aadf2975868

    • SSDEEP

      1536:M3dFtO4xLk8u2qHlllllllOdQlwEn+glllllllllllllllllll5xw5lf:MtXFjtYwiVxw5lf

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

    • Deletes itself

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks