purelogstealer | d46fea1913a10aa5cd4d1a7815b44bb93750bc06e2673857a0c314704a518a59

Sharing

Copy URL Twitter E-mail

General

Target
TT ViewBot v3.7.zip
Size 266KB
Sample240827-precws1bkd
SHA256 d46fea1913a10aa5cd4d1a7815b44bb93750bc06e2673857a0c314704a518a59
MD5 e46d36d1360b8457c032b66c6daff409
SHA1 bdfc45dc35f9d373e50cb537b87a8f8e5320ca47
SHA512 3d82ea94f04cb8ef973ca41eec465aa6e61710523fd2dab6c993ae25f8ef464f80700047f878452ea790bc57780b94a002425e6b076e3537bca2da1637a6fcb3
SSDEEP 6144:k97VDohTUgnNiQeDveFdGnP710V6A2F8f7kE8ISFqRaVZSV5Ve4HPc:k9hDoBUI9ebeFu710VsCQEsFqRVe4vc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  TT ViewBot v3.7/Data/Lists.py
- Size 2KB
- SHA256 b21702251cf0e88c166088d4e08294b2b0c2f961da8056ac48c735243d554279
- MD5 58b844082767dd40b291276087b6323b
- SHA1 41748aed3409eeb4be7a8d53b98a81fcfff2323d
- SHA512 f50268442358d511424d649603ce701cda7bb885cdfe005c8fbcdbde2b47784102b7196438d664ef4c32b5c317ad9e9b8ec7f1ed741d3aef399f378149c61547
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  TT ViewBot v3.7/Data/ScrapProxie.py
- Size 8KB
- SHA256 8fd6afc4c92b8c65eb96a7493e559c83449578fcf178e20d9d126b411eead5e5
- MD5 005e6b6cd75e6fd6040731c64494e537
- SHA1 86f24fc5aad569829e0651bdcd607168c19c58f6
- SHA512 a16848eda731c6e7591b94a7291095a19fca11ecdd2e4b1e55306f28b288bc473f2bad97bb505c0c8fd4d3a7e7227103427ac5aed1bf6bd3b21f6bce3e785931
- SSDEEP 96:QSGcG6lghWnE559ZlWoxKMk59Vp+pvey9t9c9xsRvRxY1K7DpCgkTli:P659ZwoxKMW9Vp+pmYHexscU9j
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  TT ViewBot v3.7/Data/UserAgent.py
- Size 1.0MB
- SHA256 8ec04b593bbf03b344809ebca690dcec7bc082bccd0e28d3b4931b371ab044c9
- MD5 0c9b29e6b8291144a8a1c7b190accbe5
- SHA1 a5946876fb6de43a28c9b3d3b783c755f74f41f1
- SHA512 cc8ad93051da8b447064d4c3dbaab624b8fa4516874358a1dfe2d52ac03a87f104b6cae8b036c42c87c7d9b1946138d9a0f4f7f5ed2db62b0a771901e1ec5cfe
- SSDEEP 384:UKxzhaSY5IiEgeBLPxKQheqwF3zdU49rdobwjkH6g6QcOHcoR8AnaREHszt3Y3fO:e
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  TT ViewBot v3.7/bot_start.exe
- Size 197KB
- SHA256 c4174541aa2cef599aee7a376e5de3393446f0018a850fcf1c6658da9692bed5
- MD5 9c29f4415a735c3d9ee26ca06385d502
- SHA1 127b2d6c2e63bf3ff6fb8fb055a272e088fd851d
- SHA512 ac2cf91b4ef1dc72c10d5affa83305aa011b733ffc7ce10b87efe8e91d2a9dda72a52a3806f8a20e6bd02a1873677d74a793d5359c8e235bf64fdd23946927d6
- SSDEEP 1536:cHc9JW77pHtDEOFYPUh7N9H/sPafochTLZ61tISqS9HwRXBuS7pR72BfLJFBLbbI:ayy9HwSLZ6vTjHwBBybvIJe9
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

purelogstealer discovery stealer credential_access persistence spyware
- PureLog Stealer
  PureLog Stealer is an infostealer written in C#.
  stealer purelogstealer
- PureLog Stealer payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  TT ViewBot v3.7/setup.py
- Size 941B
- SHA256 1291ef03e04110780a294bb9608358901fb86ea235840fbd49ffe7beeb6c4da4
- MD5 eda4ba41910e22351b9181d552cf3b1c
- SHA1 bf2fa5977b13b6ae80a4a1915d8025f75eca16fd
- SHA512 1f6bcfd592c408acc45ec680ca78d01f15ed5ff3a7aaa632410923f4b661de671d9a5db6dd14b1695dcad37979b053df2d9d3067be8d5a51687bc583fda89ed2
- MD5 SHA1 SHA512
Score

3^/10
behavioral10 behavioral9