Overview

overview

10

Static

static

10

Mswgoudnv.exe

windows7-x64

10

Mswgoudnv.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Mswgoudnv.exe

  • Size

    924KB

  • Sample

    240826-e7kjqsvfrh

  • MD5

    de64bb0f39113e48a8499d3401461cf8

  • SHA1

    8d78c2d4701e4596e87e3f09adde214a2a2033e8

  • SHA256

    64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a

  • SHA512

    35b7cdcfb866dcdc79be34066a9ad5a8058b80e68925aeb23708606149841022de17e9d205389c13803c01e356174a2f657773df7d53f889e4e1fc1d68074179

  • SSDEEP

    24576:NAHFp2K15zXnjfQb6+jFb5RIAJTOcA4gnPdCPPd7wm:WHf15zM5JbtA4wPdCnd75

Score
10/10
purelogstealerdiscoverypersistencestealer

Malware Config

Targets

    • Target

      Mswgoudnv.exe

    • Size

      924KB

    • MD5

      de64bb0f39113e48a8499d3401461cf8

    • SHA1

      8d78c2d4701e4596e87e3f09adde214a2a2033e8

    • SHA256

      64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a

    • SHA512

      35b7cdcfb866dcdc79be34066a9ad5a8058b80e68925aeb23708606149841022de17e9d205389c13803c01e356174a2f657773df7d53f889e4e1fc1d68074179

    • SSDEEP

      24576:NAHFp2K15zXnjfQb6+jFb5RIAJTOcA4gnPdCPPd7wm:WHf15zM5JbtA4wPdCnd75

    Score
    10/10
    purelogstealerdiscoverypersistencestealer

    • PureLog Stealer

      PureLog Stealer is an infostealer written in C#.

      stealerpurelogstealer

    • PureLog Stealer payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks