purelogstealer | 0496ec9393b9228f1cf3439046309cf0N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0496ec9393b9228f1cf3439046309cf0N.exe
Size

2.6MB
MD5

0496ec9393b9228f1cf3439046309cf0
SHA1

c3f51e15b43b521d2e68efd353849ebd03e937ee
SHA256

e4a91db9e43655931fd3926ec00dbe8a063fbe0d3f0af7d902fd3b9d8281fb3d
SHA512

837b8dbcfa80d43750ffda475afd033349a8c66f588344ceee73f7514645a3f51666a5da67239107b0d6478cad49ddf3064573ff188f419cce7dafc54171a9b2
SSDEEP

49152:PCcb3XPMd1Lqaj/pkauqsL2GNX4TeXymmyQTPmsCLzIvkmdZG2iP:qJ1LqaTptuLL2GasmKzY5

Score

10^/10

purelogstealer

Malware Config

Signatures

PureLog Stealer payload 1 IoCs

resource	yara_rule
sample	family_purelog_stealer

Purelogstealer family
purelogstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0496ec9393b9228f1cf3439046309cf0N.exe

Files

0496ec9393b9228f1cf3439046309cf0N.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ