MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ae0181d52bb1f6fbd4143e7aa6aa4d1f0ded970397dae076ba6a5fc4cd9ebf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureCrypter

Vendor detections: 13

Intelligence 13 IOCs YARA 14 File information Comments

SHA256 hash:	9ae0181d52bb1f6fbd4143e7aa6aa4d1f0ded970397dae076ba6a5fc4cd9ebf9
SHA3-384 hash:	58d47b4b574c6a275f0767e39018cc99a739a81763312cfe8e08466a357f6d07509b8758ad6d9b07a1bccee63ea095fe
SHA1 hash:	686d080e25858c73bab89d947ccd065e39b65b7f
MD5 hash:	1fd60437b6bb08deb983ac9c886877b2
humanhash:	undress-victor-jig-beer
File name:	9ae0181d52bb1f6fbd4143e7aa6aa4d1f0ded970397dae076ba6a5fc4cd9ebf9
Download:	download sample
Signature	PureCrypter Create hunting rule
File size:	2'282'536 bytes
First seen:	2025-04-22 12:38:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d030cec31210650cbc8dbccbb49af225 (1 x PureCrypter)
ssdeep	24576:Z+RhXBPjTgHjD7E7E6mhF1YJnsmbj1UFDlgnsqbHf1H2h4hZXmQXlgc2EeOC3Ddb:SljsHTE7E3n1YmppSXNIYnf71CffR
Threatray	352 similar samples on MalwareBazaar
TLSH	T11FB5CE14E3E801B8D86BD774CA659333D6B079961330E58F0699D6452FB3EA29F3B702
TrID	66.6% (.EXE) InstallShield setup (43053/19/16) 16.2% (.EXE) Win64 Executable (generic) (10522/11/4) 7.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.1% (.EXE) OS/2 Executable (generic) (2029/13) 3.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	48d4f4f0f0f0d8c0 (37 x RedLineStealer, 18 x AgentTesla, 9 x SnakeKeylogger)
Reporter	JAMESWT_WT
Tags:	exe MonniSoftwareOy purecrypter signed

Code Signing Certificate

Organisation:	Monni Software Oy
Issuer:	SSL.com EV Code Signing Intermediate CA RSA R3
Algorithm:	sha256WithRSAEncryption
Valid from:	2025-02-07T17:37:35Z
Valid to:	2026-02-07T17:37:35Z
Serial number:	46e097ebe44bf0363e5830369d708b81
Intelligence:	4 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:	This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:	SHA256
Thumbprint:	88de188144f0fc056a79889463306c22f1fce4e97c234cf2b76c260ce8b17d6e
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

436

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/3415/

Detection(s):

Win.Packed.Boxter-10005643-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68078f09892d799f537abec0

Tags:

gensteal crysan virus sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Сreating synchronization primitives

Connection attempt

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

entropy fingerprint lolbin microsoft_visual_cc packed packed packer_detected remote signed

Link:

https://www.filescan.io/uploads/68078df590767142c3dfd579/reports/8fbba830-e241-4935-9d29-bfde57648c9b/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/9ae0181d52bb1f6fbd4143e7aa6aa4d1f0ded970397dae076ba6a5fc4cd9ebf9

Malware family:

Rhadamanthys

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/580fb061-1b85-458b-ab75-bf80b34c4e6b

Result

Threat name:

PureCrypter

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1671038

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Allocates memory in foreign processes

Detected PureCrypter Trojan

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Suricata IDS alerts for network traffic

Tries to harvest and steal Bitcoin Wallet information

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9ae0181d52bb1f6fbd4143e7aa6aa4d1f0ded970397dae076ba6a5fc4cd9ebf9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9ae0181d52bb1f6fbd4143e7aa6aa4d1f0ded970397dae076ba6a5fc4cd9ebf9/

Threat name:

Win64.Trojan.GenSteal

Status:

Malicious

First seen:

2025-04-18 12:31:00 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tlqbqhksxmpw7pkbipt2u2ve2hyn5wlqhf624b3lu2s7ytgz5p4q._file

Verdict:

malicious

Label(s):

unc_loader_044

resolverrat

PureCrypter

374c270caa42b3ba1a0b31c33a47fe590c38ef8997845d48ae3fb8a575f7d608

PureCrypter

7977ce0e5277b4e5e028bbded8d565c83e6e9331771b325cc1d6915e599b7aef

PureCrypter

9ae0181d52bb1f6fbd4143e7aa6aa4d1f0ded970397dae076ba6a5fc4cd9ebf9

PureCrypter

c0962567f2ea0c674de5da865848031922d6c3fecc93bc9caf4ce5db4cccbf59

PureCrypter

d539d8a4e3ca4d3b94d072bdf9638ef870f3a77967ea1c9bdf606b892bcb016d

PureCrypter

error

PureCrypter

+ 342 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/250422-pvq6vsyrv7/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Verdict:

Malicious

Tags:

Win.Packed.Boxter-10005643-0

YARA:

n/a

Link:

https://app.threat.zone/submission/d330ab83-92eb-4410-9cb7-0626e3b0a313

Unpacked files

SH256 hash:

9ae0181d52bb1f6fbd4143e7aa6aa4d1f0ded970397dae076ba6a5fc4cd9ebf9

MD5 hash:

1fd60437b6bb08deb983ac9c886877b2

SHA1 hash:

686d080e25858c73bab89d947ccd065e39b65b7f

Link:

https://www.unpac.me/results/59bb6cbf-1d18-42b7-a7fd-0420c57c8989/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9ae0181d52bb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9ae0181d52bb1f6fbd4143e7aa6aa4d1f0ded970397dae076ba6a5fc4cd9ebf9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/3415/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AdjustTokenPrivileges
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::OpenProcessToken KERNEL32.dll::OpenProcess KERNEL32.dll::VirtualAllocExNuma KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueW
WIN_BCRYPT_API	Can Encrypt Files	bcrypt.dll::BCryptGenRandom
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample