Overview

overview

10

Static

static

10

81f91061c6...aa.exe

windows7-x64

10

81f91061c6...aa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe

  • Size

    976KB

  • Sample

    240820-tvekaawann

  • MD5

    902f14b6f32cc40a82d6a0f2c41208ec

  • SHA1

    c01e5bc3e9dbb84a5b36841045055999fc0a16cf

  • SHA256

    81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa

  • SHA512

    d55e184309e122ffbe3097bfb64b3e23829228cd16030dca5856bfa1725bc60c2da04bf04c8919ca658ca4b7b03e4be6e6bc9240b5816903609969213be2f97c

  • SSDEEP

    24576:1Ibj07xMVrpydHnnDfiDw8PZIykCu3oxmv2GX:1+ukYxDqnZTlns2

Score
10/10
purelogstealerdiscoverypersistencestealer

Malware Config

Targets

    • Target

      81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe

    • Size

      976KB

    • MD5

      902f14b6f32cc40a82d6a0f2c41208ec

    • SHA1

      c01e5bc3e9dbb84a5b36841045055999fc0a16cf

    • SHA256

      81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa

    • SHA512

      d55e184309e122ffbe3097bfb64b3e23829228cd16030dca5856bfa1725bc60c2da04bf04c8919ca658ca4b7b03e4be6e6bc9240b5816903609969213be2f97c

    • SSDEEP

      24576:1Ibj07xMVrpydHnnDfiDw8PZIykCu3oxmv2GX:1+ukYxDqnZTlns2

    Score
    10/10
    purelogstealerdiscoverypersistencestealer

    • PureLog Stealer

      PureLog Stealer is an infostealer written in C#.

      stealerpurelogstealer

    • PureLog Stealer payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks