36231b9b933f41b9d60a3606212f579d1d61700f18876e2d7d0edef781f75c55

Sharing

Copy URL Twitter E-mail

General

Target
Purity WIN MAC.zip
Size 112.5MB
Sample260807-b26cgavfnd
SHA256 36231b9b933f41b9d60a3606212f579d1d61700f18876e2d7d0edef781f75c55
MD5 4c634b1c911116453b4325d0ecf2892c
SHA1 91d3a7d407deb93ac578e68d034a8e0096b2f22d
SHA512 d61f8a44f2ecb72328cdebeca9874f6e2b10cf8daa040f28d9862bd645dbf959186f25efd383d1d74499a11d162d4fddca0d64e984456f94ffc6fc8a97429eb6
SSDEEP 3145728:r+Bkzg1K4NvqQDc0x/KIZd6+IzbzF5VDaPD:k1KwqyCI8F5la7
TLSH
T1A9483368C0497C17D1B1E87D642B781072DA22A8660BFE95E73B2B7C059B7D687FC342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Purity_Setup.dmg
- Size 61.0MB
- SHA256 a3e1808e224d899b85ff445f316ace9b71965a77ec41af0599df8fcf366b05d9
- MD5 1f4481b94e8b5a418474bf17ff66ebdc
- SHA1 a4e771a2aec7689c160b918ae93d60ccbb73c744
- SHA512 de50d80db091dead00927d2760b6b15599c76f328c2cc4fb6d6c73ab81451fcb692fa4137099fe23dc4976d65ca638252061c3a28ec0ac69a40a14b843232ddc
- SSDEEP 1572864:co3UWeSbciI0b3iicrT2gp02Vxp5h7+6iJTNGC7Vv:cUUW1bciI0b39crT24rlnMTNvv
- TLSH
  T1BBE73377F4C4691FE9B2DBBEE6A138100CE7769B551E980E2B67EFD440C630092AC746
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1
- Target
  Applications/LUXONIX/Purity.app/Contents/MacOS/Purity
- Size 92KB
- SHA256 67146fe3e4dd96e96c4caa03c1eac3d7f5d8706b327135a53d1549693141d261
- MD5 6e885ef775b6fc5954a99668370d2c66
- SHA1 13bb98ef8396cd88dd656634f74cf2be372e538e
- SHA512 98ad9c9b70bae3e997a547b36159b13cd3467de0185d46b3c8e291bd1628996f7ff599ed81a964689f806cc50da76ef676c05e1f95e85b0623fe45917fab2acf
- SSDEEP 1536:2tEPA20fAUZR2uBCD+AF3QNA66tJrrKHeru907AL8k2hvUwP2ZJBl2dZGNg2Tt0i:2tEPA20fAUZBCD+AF3QNA66tJTs8kWUt
- TLSH
  T13E93F803FF1D49B3CDE51BB5226B671B432FE98850228F46B704EE0D5FB32595C06AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  Applications/LUXONIX/Uninstaller/uninstall Purity.command
- Size 2KB
- SHA256 3765fbb887221b44566af7a15c208476a640829351ed0b2f01ec730364614864
- MD5 464ac92eb3b884d960122999cbc6b998
- SHA1 d3c92ed15d42a320f85031602e5c3b5a54a70e1a
- SHA512 569f0bee80310aabb5481de63567ab4a87af6526f21f788271393f76f3399458fb6f8d8a2a626e1d48378ebc6f42004de5a913125a10d68e7bab5be7315ba03e
- TLSH
  T16D41F9A1BC90A6D106E5D1FB711305CEE0B224394A4F3DB8788BA9ED6313F49535E52F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  Library/Application Support/LUXONIX/Purity/Purity.pdf
- Size 5.8MB
- SHA256 030fc6fa8d631a33b5ba7cb8e6b87ebd32078eb59a41046f65129fa5dd9125bd
- MD5 008c72746e787c5ef253b1fba3c18971
- SHA1 53c5c2ee202aa3d7f87e5b230d4490984c7df03a
- SHA512 44891741d105f163c140aa3146f392e7ff037ba20631f8c894c3d4842c7db92bd75cb1b5c77e82ab2c5dd7301f4d81377a8a73a7c27744b22a6e7f49a59f1f12
- SSDEEP 98304:TPwg0HtUYFw9xH4KCjS4SDzSAFsRaVJGUNDBTM2xzDjUi6WashM:zAUPxTCYzTuQV11HxzDAWaZ
- TLSH
  T1C856334C86476C9CF566171538059C5ECDBB3893C88CB8737F6DEAA107C8EAE40A6ED4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral4
- Target
  LUXONIX_Purity_1_2_5_mac/LUXONIX_Purity_1_2_5_mac.pkg/Contents/Resources/English.lproj/License.rtf
- Size 40KB
- SHA256 fb015208aebd11f86bf1e8ea61a81d5792c1cc09ae3acdecc62e0da6c300a5c7
- MD5 5bfec4bb8e5f8c3a179596c7fe858b89
- SHA1 af5e5360e7841edc30dccc291ec5025290873054
- SHA512 860c89a9b3518248b7f227f622db65a3c8789f8da7fe7637f346c91e97d29f5ffd887bb3d6ad72cd4d14b169a26ff53c2c02d5dea2e22b1290079e50e23ff683
- SSDEEP 384:w5lPHzNF//CpEJ2ny7g7xOSNNpLgheo75Y3kFA9dQbxuJ3Ei3M:w5lL8EJ2ewJXpLgcZ4wdQ1CUi8
- TLSH
  T1991352B844454BA5D3936396FB15F0887B2BF41928E584E431EFD3BE213FEACD522522
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  LUXONIX_Purity_1_2_5_mac/LUXONIX_Purity_1_2_5_mac.pkg/Contents/Resources/ko.lproj/License.rtf
- Size 150KB
- SHA256 da50b8d801c75a2b6ede99dd4926c6733aa00f5137de449653dceeb80117b4bb
- MD5 ccdc2a1326707e373cf0f6c89a7d1b9a
- SHA1 6714b3c8c3857b111e44014bc9efd0b70aca3e21
- SHA512 9190561b0fa88ed6245ef5d1003048a3d92e322224e8ccef93a614f1cac5ac660964e71b13e266c9a0695384ff28fc019da7c6daa00257dda5ce2fffcb02364b
- SSDEEP 768:w55YwzX2YMZzC7I9GGodN/2z2MHdF2fopLNEpd0A2sfOjEQBfaW3JBACxL0fDe5N:w55Y0NdJXNCuY3G5PoWcchQAUiC
- TLSH
  T10CE304B8C4429BE1D3A0E7E77906F0DD6C379418B1B90A6519BFC1EB113FE38D5260A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  LUXONIX_Purity_1_2_5_mac/LUXONIX_Purity_1_2_5_mac.pkg/Contents/Resources/postflight
- Size 116B
- SHA256 b2bcc48a55338311b4a601657d480d10c07263e4c7234f956c50f948446d204b
- MD5 e8c45910a514969011cf1ff43e569898
- SHA1 3dbd75dff9a25c20d97d9013aa97848cdd7751c0
- SHA512 6347d06cff968fe0acc8e4c089ff583b6bf125711ba1788f8078a3f51091a4939de3dc6f9e04bc30d5b0fde709cbfa9eaecbefc2c50c7bd01dd2e1071b7ac1ce
- TLSH
  T1E5B092404091E0A402ECD365162257BD9092F233166B0AB051821565A142F6DD083E73
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  Purity_Setup.exe
- Size 51.8MB
- SHA256 5a346e16df8a4e5b3af84833fac97469a3a268375b7181cfa61e5a2155e64adf
- MD5 aac0c1284f826f64b438fd548545c2f6
- SHA1 2d2c2b660fa3d956ee0ab3d1157458a736264b4b
- SHA512 0526c2065641a7289995c7027d1e57308eaf9664ee24589ea9720cef67bad07f7ab27a5b98939160a9d619b689986b87a86070df80b7c223161e7fae883874e1
- SSDEEP 786432:sz/s4XCJrQXhuHnYvw6rbMtmHcZ3oiqB6hyGBC3Ig4UTKVgEWkoG6ef3+yv:uD2EXIHhCQo8FoiAZ4UuVgEW/Gtv
- TLSH
  T1EDC73330112FC842D0B6687E242BB911B7AE3C997647BB66F1787039427B7D6CDE9213
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral8
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH
  T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- MD5 9384f4007c492d4fa040924f31c00166
- SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
- TLSH
  T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  $R0
- Size 617KB
- SHA256 9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46
- MD5 1169436ee42f860c7db37a4692b38f0e
- SHA1 4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3
- SHA512 e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0
- SSDEEP 12288:bxzh9hH5RVKTp0G+vjhr46CIw+0yZmGyYCj:bph9hHzVKOpXwymGyYo
- TLSH
  T196D4CF51B5E3C472D0B201B5490ADB3A9A3BB9504638A8737BE60FCE4E787D1FB17252
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  $_4_/Purity.dll
- Size 4.0MB
- SHA256 53e68f8db449580fb51eddb573bdef21901065eb4df9f31ba4747072160d33cc
- MD5 be6178ac796756340d892abc423ad21c
- SHA1 e8adf475efc25eea4abd4e41cb26b34724a8abc7
- SHA512 64a0a3de69c1c13442be5c9fbd8396223b2a8392de3fa62ae93f04cd63e15e79878e800f6c357e66ff484f68ddc3a87ad65c265c51243d296573c52405703371
- SSDEEP 49152:bgUWXEvPLfjI8f10Szr78O+hzi48MJxNHeLV2F2JvPZmLklaBfg:bgUWUvPLfjI8fLzX8dzi48MJxReVb2
- TLSH
  T17416D758E93D1EC8FA78693C5174F1808A914E5DA301E56FB8ACFA918D373903678F9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  Purity.dll
- Size 4.0MB
- SHA256 53e68f8db449580fb51eddb573bdef21901065eb4df9f31ba4747072160d33cc
- MD5 be6178ac796756340d892abc423ad21c
- SHA1 e8adf475efc25eea4abd4e41cb26b34724a8abc7
- SHA512 64a0a3de69c1c13442be5c9fbd8396223b2a8392de3fa62ae93f04cd63e15e79878e800f6c357e66ff484f68ddc3a87ad65c265c51243d296573c52405703371
- SSDEEP 49152:bgUWXEvPLfjI8f10Szr78O+hzi48MJxNHeLV2F2JvPZmLklaBfg:bgUWUvPLfjI8fLzX8dzi48MJxReVb2
- TLSH
  T17416D758E93D1EC8FA78693C5174F1808A914E5DA301E56FB8ACFA918D373903678F9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  Purity.exe
- Size 328KB
- SHA256 1d790e0fb5e574eb496bc674044b74d6b3c555f95bec238be37c7f118b30c929
- MD5 5cec7e66b017cf0cadf9b8eb2e3adac3
- SHA1 ec713a689f001e934258aa8c3fbae1502a279fd1
- SHA512 b7dbf45ce6db4e0df6c87cdafd677c7afa374db6e16d5b3073099536616c2757ad39b8b8b5d884046c674351569232762132673683c335931845349a7c3f7f82
- SSDEEP 6144:6DnLrJIyIzJXgJPLk88wbbXz6uU2yZAOeMVUYVhnkgbM9t:6LXSOH9UbZgMqYVhngt
- TLSH
  T18564AD3036E6C8B3C4A6413590EA8B1A6BBEBC56573455DB23A0BE1F8A357C04C773B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  Purity.pdf
- Size 5.8MB
- SHA256 030fc6fa8d631a33b5ba7cb8e6b87ebd32078eb59a41046f65129fa5dd9125bd
- MD5 008c72746e787c5ef253b1fba3c18971
- SHA1 53c5c2ee202aa3d7f87e5b230d4490984c7df03a
- SHA512 44891741d105f163c140aa3146f392e7ff037ba20631f8c894c3d4842c7db92bd75cb1b5c77e82ab2c5dd7301f4d81377a8a73a7c27744b22a6e7f49a59f1f12
- SSDEEP 98304:TPwg0HtUYFw9xH4KCjS4SDzSAFsRaVJGUNDBTM2xzDjUi6WashM:zAUPxTCYzTuQV11HxzDAWaZ
- TLSH
  T1C856334C86476C9CF566171538059C5ECDBB3893C88CB8737F6DEAA107C8EAE40A6ED4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral16
- Target
  msvcr80.dll
- Size 617KB
- SHA256 9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46
- MD5 1169436ee42f860c7db37a4692b38f0e
- SHA1 4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3
- SHA512 e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0
- SSDEEP 12288:bxzh9hH5RVKTp0G+vjhr46CIw+0yZmGyYCj:bph9hHzVKOpXwymGyYo
- TLSH
  T196D4CF51B5E3C472D0B201B5490ADB3A9A3BB9504638A8737BE60FCE4E787D1FB17252
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  uninst Purity.exe
- Size 212KB
- SHA256 5869a0ebad4731751c9c21975a2861363fabd79985fe93d3c4cb3595a6da23c7
- MD5 cd3286e328c8f5a6cfc58bccfdc6b6ba
- SHA1 a39ff471ec081ec1a89d5511e1a87fd1c2e4462d
- SHA512 a96ca8cc6ee6e26940345bbeb2a639577322b03fa0146f24ba5fca3e7a1313c3e7911fb8a3b232dab75a958a3acbb970466979089d5fb90b05602c4b3142b53a
- SSDEEP 3072:XLk395hYXJewl03IT2TkMjKK1HNz0DPWFjdhdWdyWmlvJYDBW7gYN:XQqkwkI6kMBn0KFj18IYWF
- TLSH
  T190248C447188846BCE5A42334F279B5FE9634ADD5D30211B2AACAF6F393737711288F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral18
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH
  T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- MD5 9384f4007c492d4fa040924f31c00166
- SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
- TLSH
  T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20