MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0445c751a3a237edf0e3c76d7ca9736318b2b259b2b12f1ddda9ff10773e71cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0445c751a3a237edf0e3c76d7ca9736318b2b259b2b12f1ddda9ff10773e71cc
SHA3-384 hash: 232b49b78dd1f7bce4e0515b920649388a6a2b3de58b0532629f77bb2d91bf7a1615a552f2e2e24acedc92c821841e5f
SHA1 hash: c1c7347e2e62f1e775ec09aa8f3dee09c22e7867
MD5 hash: 4b3147b0a5bb2edad6d257273fd41975
humanhash: aspen-london-kentucky-kansas
File name:LS25303731_Copy.pdf.exe
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'065'984 bytes
First seen:2025-11-03 14:59:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:KTAyR2NAYeA9o4ARmhOIS74xbWpT8nnKSx+JVM1bxGOND:KT/MARaNxbWpT8nK7Md
Threatray 548 similar samples on MalwareBazaar
TLSH T1933512281A26D706DDA193F14AA2F2F517BD8DAAB902D146CECCBDDB7873F000944E53
TrID 35.4% (.EXE) Win64 Executable (generic) (10522/11/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4504/4/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter pr0xylife
Tags:exe PureLogsStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.149.24.121:11044 https://threatfox.abuse.ch/ioc/1632485/

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
LS25303731_Copy.pdf.exe
Verdict:
Malicious activity
Analysis date:
2025-11-03 15:02:45 UTC
Tags:
stealer purecrypter auto-sch-xml purehvnc netreactor amsi-bypass
Link:
https://app.any.run/tasks/4dc3aa2a-28f5-4f6b-acfe-19414311c1c8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/35166/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6908c3609942f1282ecbb307
Tags:
underscore shell spawn sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0445c751a3a237edf0e3c76d7ca9736318b2b259b2b12f1ddda9ff10773e71cc
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-03T10:31:00Z UTC
Last seen:
2025-11-05T05:12:00Z UTC
Hits:
~100
Detections:
PDM:Trojan.Win32.Generic PDM:Trojan.Win32.Badex.d Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb HEUR:Trojan.MSIL.Taskun.sb HEUR:Trojan.MSIL.Agent.gen Trojan-PSW.PureLogs.TCP.C&C
Link:
https://opentip.kaspersky.com/0445c751a3a237edf0e3c76d7ca9736318b2b259b2b12f1ddda9ff10773e71cc/results?tab=lookup
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a88a6afa-00d5-40fe-b7f0-0aebe63cdd47
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0445c751a3a237edf0e3c76d7ca9736318b2b259b2b12f1ddda9ff10773e71cc
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.32 Win 32 Exe x86
Link:
https://app.malva.re/file/4b3147b0a5bb2edad6d257273fd41975
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0445c751a3a237edf0e3c76d7ca9736318b2b259b2b12f1ddda9ff10773e71cc/
Verdict:
Malicious
Threat:
Trojan.MSIL.Agent
Link:
https://tip.neiki.dev/file/0445c751a3a237edf0e3c76d7ca9736318b2b259b2b12f1ddda9ff10773e71cc
Threat name:
ByteCode-MSIL.Trojan.XWorm
Create hunting rule
Status:
Malicious
First seen:
2025-11-03 14:37:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=arc4oundui3634hdy5wxzkltmmmlfmszwkys6ho5vh7ra5z6ohga._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
unc_loader_037
Create hunting rule
purecrypter
Create hunting rule
katzstealer
Create hunting rule
Similar samples:
0445c751a3a237edf0e3c76d7ca9736318b2b259b2b12f1ddda9ff10773e71cc
PureLogsStealer
94108630d716276356f19d0234acadd67b10b6aff76cd124a19850f37b2e121d
PureLogsStealer
acfd0a48223c3e021532b6f7cfb12e81ebf2903bd706b9a5d45fb1a020dd7902
PureLogsStealer
ca5b85e2100535294f607ba63fa782b2652397c1c1258fb0d15ad256a6f779e5
PureLogsStealer
e32106acd96a999a03b99006e21555b4829b2067fec0d00cd17e4235e631b621
PureLogsStealer
error
PureLogsStealer
+ 538 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/251103-sh2cvagr2t/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Executes dropped EXE
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/08f4c384-bdeb-4498-9029-7614eb276c5f
Unpacked files
SH256 hash:
f84020c3d1efa2418c9645a1de8ab0803fdf20a60e8ecb1c8ae689505f0b0708
MD5 hash:
4c6b24b7b142d1d3945c8e550ad79291
SHA1 hash:
3de4e3b6e32ba3733e0563ff2e5fc04062554292
Link:
https://www.unpac.me/results/6e2179ce-8a06-47a3-8077-2625d9535236/
SH256 hash:
7735d18584f13f40f4e652deb53d33d520b0d0663ee9208f1d1f1fadefb4b7e2
MD5 hash:
65a36b4074edafa38d3e79eb20ef8a83
SHA1 hash:
6851ab2572954791e4754b0db31ecd656e97b1c5
Link:
https://www.unpac.me/results/6e2179ce-8a06-47a3-8077-2625d9535236/
SH256 hash:
f6db61a08e6bfd4ddf7eb751a406c220c482d583243864283fd1c133a38c4ad2
MD5 hash:
cdce834e5dedc1e4afbbdfd59b87dac9
SHA1 hash:
7199e7794c4a86baf24c4c8019d5999c01a6b040
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/6e2179ce-8a06-47a3-8077-2625d9535236/
SH256 hash:
b66585890ce821a125a91a0565f5e27b933fbc6ff17f4b7b4245ab7d238bcd29
MD5 hash:
bf20b058a1350da215fc1ee6af56187d
SHA1 hash:
7ccf00e05941d11630d8f975d6779f9d6819d4a8
Link:
https://www.unpac.me/results/6e2179ce-8a06-47a3-8077-2625d9535236/
SH256 hash:
c60c6c759be78f5e56d2628ac7a0679639cc5033d15f8b8563f2f2f7c9b18b3e
MD5 hash:
86b6d529bfcb37163f7e00c6ce7caa45
SHA1 hash:
8ead7567669d618ee47a1a316cf8ce5c2239baf1
Link:
https://www.unpac.me/results/6e2179ce-8a06-47a3-8077-2625d9535236/
SH256 hash:
4dfe3e69688fcfda49cd14d32a022225d0581da18fe329861b81dc523dda0c73
MD5 hash:
4c700390540010bf930996338d26aa33
SHA1 hash:
cde5fd4cb97be842364259bce762b7d98c9eda55
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/6e2179ce-8a06-47a3-8077-2625d9535236/
SH256 hash:
0445c751a3a237edf0e3c76d7ca9736318b2b259b2b12f1ddda9ff10773e71cc
MD5 hash:
4b3147b0a5bb2edad6d257273fd41975
SHA1 hash:
c1c7347e2e62f1e775ec09aa8f3dee09c22e7867
Link:
https://www.unpac.me/results/6e2179ce-8a06-47a3-8077-2625d9535236/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0445c751a3a2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0445c751a3a237edf0e3c76d7ca9736318b2b259b2b12f1ddda9ff10773e71cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/35166/

Comments