purecrypter | TR-31Payment091-H462-J828-N3091-B5740-UHA910-786F-CN87402-M8198[.]lzh[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
TR-31Payment091-H462-J828-N3091-B5740-UHA910-786F-CN87402-M8198.lzh.rar
Size 48KB
Sample260521-sl3ebabv2t
SHA256 6943ab211f5bd816bfa51f3a1c85c8789597959e33c2dcbaabc090bac88a915e
MD5 9193d76e7df5d736b0b8388c36272dc5
SHA1 91effcb03a4654ec6d736051da714a98d3f519ab
SHA512 c9e2e3c177e8311f7701280c2597302d6035afa0c4ba4e07046b892448cb9d4bbc93e7f2510eef2f7916e5412b2ffffbd8f113462491c13d21c9a19c9e449502
SSDEEP 1536:tvv3ab9k/fnK5MJ6dZxYSZ3MrObE2KoEjGUL:Zvqb9k/S5M2YS9MaIHl
TLSH
T1AC23F19305F2AA5C011FE065D12131A86733745BDA62180D6AE78D07DF8FEDE3E7D6A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

loader downloader purecrypter

Malware Config

Extracted

Family

purecrypter

http://skf-mx.com/debut/Wyicucycyhu.mp4

Signatures

Family: PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
unpack001/TR-31Payment091-H462-J828-N3091-B5740-UHA910-786F-CN87402-M8198.exe

File Explorer

TR-31Payment091-H462-J828-N3091-B5740-UHA910-786F-CN87402-M8198.lzh.rar

.rar 48KB
TR-31Payment091-H462-J828-N3091-B5740-UHA910-786F-CN87402-M8198.exe

.exe 99KB

TR-31Payment091-H462-J828-N3091-B5740-UHA910-786F-CN87402-M8198.lzh.rar

SHA256 6943ab211f5bd816bfa51f3a1c85c8789597959e33c2dcbaabc090bac88a915e
MD5 9193d76e7df5d736b0b8388c36272dc5
SHA1 91effcb03a4654ec6d736051da714a98d3f519ab
SHA512 c9e2e3c177e8311f7701280c2597302d6035afa0c4ba4e07046b892448cb9d4bbc93e7f2510eef2f7916e5412b2ffffbd8f113462491c13d21c9a19c9e449502
SSDEEP 1536:tvv3ab9k/fnK5MJ6dZxYSZ3MrObE2KoEjGUL:Zvqb9k/S5M2YS9MaIHl
TLSH
T1AC23F19305F2AA5C011FE065D12131A86733745BDA62180D6AE78D07DF8FEDE3E7D6A0
MD5 SHA1 SHA512 SSDEEP TLSH

TR-31Payment091-H462-J828-N3091-B5740-UHA910-786F-CN87402-M8198.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 771c7952a6fd5a3c5678722f96a13a42e857bb10f53f675f1dd14c5fd3dbd3db
MD5 cf953c821c4d4e0181dfbcac03c43343
SHA1 1a0de2c4e6213b26e933e0ef800b10e9d9f303cb
SHA512 20825eb07626b4ee0c59cdadfe245c11521667e51e4db7ad56b7b352abadc3c7aedef6977abb59a6d387c29bfd6b8b9bb70f3bec9fda37cb7f3eb0150d9317da
SSDEEP 1536:mw9CLvSBfrvSiEZEbWcKEZ6/G8YRlVcCOYqlbGpCVz:yervSiqEmE7qCOYqlbL
TLSH
T1BDA34BE3AA7A81A2CEB94FB1DFCE511013F0D78DA492D20E789E22051E533D1564E79F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

29:fd:60:70:b1:81:4f:78:88:c4:03:d5:0c:12:8b:b0:5c:7d:e5:5e:3d:b2:8a:45:c2:2f:d0:33:f7:fd:f3:8b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 25, 2024

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Marketplace CA G 026,OU=EOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft MarketPlace PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:44:ad:04:33:f6:08:18:96:cd:a0:4a:00:01:00:44:ad:04

Issuer

CN=Microsoft Marketplace CA G 026,OU=EOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 25, 2024 - Jun 28, 2024

Subject

CN=Microsoft MarketPlace PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:12:44:a2:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 28, 2011 - Mar 28, 2031

Subject

CN=Microsoft Marketplace CA G 026,OU=EOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5b:4e:9a:32:69:b8:ad:80:0d:00:00:00:00:00:5b

Issuer

CN=Microsoft MarketPlace PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 11, 2024 - Apr 11, 2029

Subject

CN=Dummy certificate

Serial Number

Issuer

CN=Unknown issuer

Key Usages

KeyUsageCertSign

Ext Key Usages

Timespan

Jan 1, 2013 - Apr 1, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:da:8e:d5:c9:5a:00:d1:11:b1:00:01:00:00:01:da

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 12, 2023 - Jan 10, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

48078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

TR-31Payment091-H462-J828-N3091-B5740-UHA910-786F-CN87402-M8198.lzh.rar

TR-31Payment091-H462-J828-N3091-B5740-UHA910-786F-CN87402-M8198.exe

PE Signature issue

mscoree

dotnet