purelogstealer | f5a8adbb37ce76781117aad88c8c4c9e2b8d7bdd3c3378afdb7dc37c66134b59

Sharing

Copy URL

Twitter E-mail

General

Target

sync_spoofer.exe
Size

6.8MB
Sample

240621-avlh2sxglj
MD5

7a09738f8033d766e8b03463389f0e20
SHA1

b453feaf2a393f9cb7a81804594bc0d8ddcff48d
SHA256

f5a8adbb37ce76781117aad88c8c4c9e2b8d7bdd3c3378afdb7dc37c66134b59
SHA512

6acb6043716df9c01e9a9e73963d361e4cef1608fdfd10217d1d8ed3d9ff4ca44cf5f1dbbe4f2ffd1a8de9ae71eeee0171a8cf341ce8c2085e2e40123830ad7d
SSDEEP

98304:3J86VheatbLbVVjFuvsw6TUSf47SbICvdH89fL8JaeCl9Kaw8TPObUPma9/l7i:3W6VhjFCzXSs09X789KaeQtW

Score

10^/10

Malware Config

Targets

- Target
  
  sync_spoofer.exe
- Size
  
  6.8MB
- MD5
  
  7a09738f8033d766e8b03463389f0e20
- SHA1
  
  b453feaf2a393f9cb7a81804594bc0d8ddcff48d
- SHA256
  
  f5a8adbb37ce76781117aad88c8c4c9e2b8d7bdd3c3378afdb7dc37c66134b59
- SHA512
  
  6acb6043716df9c01e9a9e73963d361e4cef1608fdfd10217d1d8ed3d9ff4ca44cf5f1dbbe4f2ffd1a8de9ae71eeee0171a8cf341ce8c2085e2e40123830ad7d
- SSDEEP
  
  98304:3J86VheatbLbVVjFuvsw6TUSf47SbICvdH89fL8JaeCl9Kaw8TPObUPma9/l7i:3W6VhjFCzXSs09X789KaeQtW
Score

10^/10

purelogstealer evasion execution persistence stealer
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- PureLog Stealer
  PureLog Stealer is an infostealer written in C#.
  stealer purelogstealer
- PureLog Stealer payload
- Nirsoft
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1