PureLogs: payload with a PNG header
PureLogs profileSwiss Post Cybersecurity documented that in the PureLogs chain the payload was carried inside a PNG-looking file and the loader unpacked it in memory. Swiss Post Cybersecurity
The small startup code in a file produced by a crypter that decrypts the embedded payload in memory and runs it.
The stub is the only visible part of the encrypted file. Its job is to decrypt the embedded data, check for an analysis environment if needed and launch the actual payload. MITRE ATT&CK
Antivirus signatures are mostly written for the stub; this is why crypter sellers change it often. MITRE ATT&CK
The user opens the file; the first code to run is the stub.
It may stop if a virtual machine or analysis tool is present. MITRE ATT&CK
It decrypts the embedded data into memory. MITRE ATT&CK
It runs the payload in its own process or inside another process. MITRE ATT&CK
Swiss Post Cybersecurity documented that in the PureLogs chain the payload was carried inside a PNG-looking file and the loader unpacked it in memory. Swiss Post Cybersecurity
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy