purecrypter | fadceca1e82b639dc996d7f6e453d7c9010193b5d8e9dafce58674a456411e9d | Triage

Sharing

General

Target

d889fc82620f1cb402b8de785364e6a3
Size

841KB
Sample

241106-sgbqss1pgy
MD5

9dc706b8d32b48a0bc079d6590f7bf86
SHA1

0e6dcfdffcb70cd9759f76adb444a39dba00166d
SHA256

fadceca1e82b639dc996d7f6e453d7c9010193b5d8e9dafce58674a456411e9d
SHA512

84ad2f91999b35a7c49ecaf813838ceb69d780138140bf73f04d13f4e8ddc2862f6d66de546b5715da28c3e04c4fc4a0027de0aad7e7c9bed7dff93ed2e2c560
SSDEEP

768:VUwtWacL+jsUZ9z+SXLkYR6/Yj6OygPXhCIMc/eHf7NQPw0:VUwtWeH/6/067gPZMc/1o0

Score

10^/10

purecrypter discovery downloader loader persistence

Malware Config

Extracted

Family

purecrypter

C2

https://andit.co/pharma/app/icon/pharma/SeemOffice_Jsbzsevl.png

Targets

- Target
  
  NewDocument002.pdf.exe
- Size
  
  668.1MB
- MD5
  
  d889fc82620f1cb402b8de785364e6a3
- SHA1
  
  f459f585dbffe403086eaeeb68ee78cf26eeee08
- SHA256
  
  f8a9e3b0e40f55e363161472b1ae42f699f14d8251685270be41a6f45d567ac6
- SHA512
  
  b1b19a1cc7f893244b5f8d67b5d8e0ede984de7d7ced46c630236373e32193805cb65bd583ec3bf361354a79c291316f1aca68c30d0d9f92a3fc95911b7f3c69
- SSDEEP
  
  1536:Prae78zjORCDGwfdCSog01313is5g8HiQWoOA:lahKyd2n31b5zHCoOA
Score

10^/10

purecrypter discovery downloader loader persistence
- PureCrypter
  PureCrypter is a .NET malware loader first seen in early 2021.
  loader downloader purecrypter
- Purecrypter family
  purecrypter
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

purecrypterdiscoverydownloaderloaderpersistence