MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07d60e2e2eeaa29464bfa3815e54f72d194a3847ae9336b30d3cf9ed3ebd0d7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07d60e2e2eeaa29464bfa3815e54f72d194a3847ae9336b30d3cf9ed3ebd0d7e
SHA3-384 hash: 4eee91f8fdaf62dbd737bf6db70e33f8057965199a9c6cafaf7bb2cb1448ec4781423fbe7ae5db2b6c57bc096f6303aa
SHA1 hash: b907f3869e69b6b8fdc7a9dbd8ebc3aa1f7e516b
MD5 hash: af637ae157add50d32f21472b31cb88b
humanhash: alaska-cold-mountain-stream
File name:USDSWIFT421-DK481-HTYC8002-039001374-CNT58000.exe
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:463'344 bytes
First seen:2025-12-04 06:01:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7eae418c7423834ffc3d79b4300bd6fb (65 x GuLoader, 23 x RemcosRAT, 18 x AgentTesla)
ssdeep 12288:pyd+Q53+SBVwnl4/+13D/hTk7MnrYzP00Z4:pydgSe+mx/hTSMnsz14
TLSH T118A42292ED51E8A3C7D21CF688ED125E4A74D32877868E4613400FD8F8993DAEB5F2D4
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 32f8ceb2f0f0b2d6 (1 x PureLogsStealer)
Reporter abuse_ch
Tags:exe PureLogsStealer signed

Code Signing Certificate

Organisation:Notacanthoid
Issuer:Notacanthoid
Algorithm:sha256WithRSAEncryption
Valid from:2025-10-11T08:56:10Z
Valid to:2026-10-11T08:56:10Z
Serial number: 456e1b70f0b7f7a96510bb450ffb3bca9f3f22a7
Thumbprint Algorithm:SHA256
Thumbprint: fc3939059bc2b8d2f8960b34521a5258ae4eabd6d03c5e1aea609143aa4e6bb6
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
PureLogsStealer C2:
86.54.42.82:5467

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
86.54.42.82:5467 https://threatfox.abuse.ch/ioc/1667473/

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
GuLoader
an XOR decryption key and an extracted component
GuLoader
a c2 URL, a useragent string, and a string XOR key
NSIS
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/2e813dad-cedb-4e4d-991c-911327de0130/
Malware family:
n/a
ID:
1
File name:
_07d60e2e2eeaa29464bfa3815e54f72d194a3847ae9336b30d3cf9ed3ebd0d7e.exe
Verdict:
Malicious activity
Analysis date:
2025-12-04 06:02:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f0006371-2144-4ab0-9427-94bb7bfe7d79

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/42398/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=693123bf264b106bd646d447
Tags:
shellcode injection blic
Verdict:
Malicious
Labled as:
Malware_53.4
Link:
https://www.hybrid-analysis.com/sample/07d60e2e2eeaa29464bfa3815e54f72d194a3847ae9336b30d3cf9ed3ebd0d7e
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-04T03:07:00Z UTC
Last seen:
2025-12-06T00:30:00Z UTC
Hits:
~100
Detections:
BSS:Trojan.Win32.Generic UDS:DangerousObject.Multi.Generic HEUR:Trojan-Dropper.Win32.Agent.gen
Link:
https://opentip.kaspersky.com/07d60e2e2eeaa29464bfa3815e54f72d194a3847ae9336b30d3cf9ed3ebd0d7e/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/342ce93f-6bd6-4cb1-9b7f-e43540b2db1f
Result
Threat name:
GuLoader, PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1826092
Signature
AI detected suspicious PE digital signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sigma detected: New RUN Key Pointing to Suspicious Folder
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Yara detected AntiVM3
Yara detected GuLoader
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1826092 Sample: USDSWIFT421-DK481-HTYC8002-... Startdate: 04/12/2025 Architecture: WINDOWS Score: 100 27 euronova-eu.com 2->27 33 Antivirus detection for dropped file 2->33 35 Antivirus / Scanner detection for submitted sample 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 6 other signatures 2->39 8 USDSWIFT421-DK481-HTYC8002-039001374-CNT58000.exe 9 72 2->8         started        signatures3 process4 file5 21 C:\Users\user\AppData\Local\...\System.dll, PE32 8->21 dropped 41 Tries to detect virtualization through RDTSC time measurements 8->41 43 Unusual module load detection (module proxying) 8->43 45 Switches to a custom stack to bypass stack traces 8->45 12 USDSWIFT421-DK481-HTYC8002-039001374-CNT58000.exe 11 8->12         started        17 USDSWIFT421-DK481-HTYC8002-039001374-CNT58000.exe 8->17         started        signatures6 process7 dnsIp8 29 euronova-eu.com 72.62.53.232, 49766, 80 SPCSUS United States 12->29 31 86.54.42.82, 49767, 49768, 49769 KCOM-SPNService-ProviderNetworkex-MistralGB United Kingdom 12->31 23 C:\Users\user\AppData\Local\...\Prinselig.exe, PE32 12->23 dropped 25 USDSWIFT421-DK481-...74-CNT58000.exe.log, ASCII 12->25 dropped 47 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->47 49 Tries to steal Mail credentials (via file / registry access) 12->49 51 Found many strings related to Crypto-Wallets (likely being stolen) 12->51 53 3 other signatures 12->53 19 USDSWIFT421-DK481-HTYC8002-039001374-CNT58000.exe 12->19         started        file9 signatures10 process11
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/07d60e2e2eeaa29464bfa3815e54f72d194a3847ae9336b30d3cf9ed3ebd0d7e
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/af637ae157add50d32f21472b31cb88b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07d60e2e2eeaa29464bfa3815e54f72d194a3847ae9336b30d3cf9ed3ebd0d7e/
Verdict:
Malicious
Threat:
Family.GULOADER
Link:
https://tip.neiki.dev/file/07d60e2e2eeaa29464bfa3815e54f72d194a3847ae9336b30d3cf9ed3ebd0d7e
Threat name:
Win32.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2025-12-04 06:01:31 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a7la4lro5krjizf7uoav4vhxfumuuochv2jtnmynht462pv5bv7a._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader discovery downloader persistence
Link:
https://tria.ge/reports/251204-gq4mdsbx9e/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Loads dropped DLL
Guloader family
Guloader,Cloudeye
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bc80447a-f054-403c-884f-0fe296d6b9e2
Unpacked files
SH256 hash:
07d60e2e2eeaa29464bfa3815e54f72d194a3847ae9336b30d3cf9ed3ebd0d7e
MD5 hash:
af637ae157add50d32f21472b31cb88b
SHA1 hash:
b907f3869e69b6b8fdc7a9dbd8ebc3aa1f7e516b
Link:
https://www.unpac.me/results/9102e584-788f-4bb1-8660-cdb7acddc2ac/
SH256 hash:
e828d0ec1ad5a7391590ca10d8e61fa2cb591291e61e2a10d49a1c2d60379819
MD5 hash:
334eaaa3003f7adf6b770f1bbc3fc570
SHA1 hash:
6d22184f0899b0e4af9a0bb0f8e68602fb9a876e
Link:
https://www.unpac.me/results/9102e584-788f-4bb1-8660-cdb7acddc2ac/
SH256 hash:
6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 hash:
8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 hash:
7cc1caaa747ee16dc894a600a4256f64fa65a9b8
Link:
https://www.unpac.me/results/9102e584-788f-4bb1-8660-cdb7acddc2ac/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/07d60e2e2eea/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/07d60e2e2eeaa29464bfa3815e54f72d194a3847ae9336b30d3cf9ed3ebd0d7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/42398/

Comments