General
-
Target
Doc000781102.rar
-
Size
27KB
-
Sample
240621-pz3qfszfpb
-
MD5
db8f5cd76145d1be8cdf411ee526b415
-
SHA1
640c922e27e700833aed9e85044057fb65d38147
-
SHA256
7e7d19f9ef7c09c8ce8e0faf25256e8a9f9d0506b7737d7244e730fd66dad3f0
-
SHA512
a6f38adb8af67d5344258b51ba117329c5f70b613550341218a7734dae39b4d164df9c390c83189ce2a0f198b6477c57b8bebe00d9dea2b33c94d8291fcecddc
-
SSDEEP
384:KW/belVah1490kGmb6YFV5U3HaFShsGbY6KQ2CAAplLT051jaV7AqvKjuNwZ7hJM:nmafUVi3+Si629au3IDvKAO+JCV/7yd
Behavioral task
behavioral1
Sample
Doc000781102.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Doc000781102.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
purecrypter
http://78.111.67.189/cn/Pffmtfdozq.pdf
Targets
-
-
Target
Doc000781102.exe
-
Size
113KB
-
MD5
c7e267629511f510ff5e8934ceb2f382
-
SHA1
814753fa8f15d440e36abd22ce908125ad972730
-
SHA256
0ca211901a9024dc07ca4973a6fe71813c5d58d468117169820d6ba91ca9f23d
-
SHA512
be04cca9194d247e665d342c62e0f9d6e26ef596fc09b6ff148b568e54b682265eff366244448745cd85d7af7702bfad4798c281a459cb65025e6aadf2975868
-
SSDEEP
1536:M3dFtO4xLk8u2qHlllllllOdQlwEn+glllllllllllllllllll5xw5lf:MtXFjtYwiVxw5lf
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-