MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 089c6fa1bc4e09739b603b68c412885ea7818339364f27a41f1b2e250e7fdb8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 089c6fa1bc4e09739b603b68c412885ea7818339364f27a41f1b2e250e7fdb8c
SHA3-384 hash: 65554fc0dfe43d6cee40ad889d2a59cefc6bf651ead203f1c1a08d0d675171868106ac3795b4239880e89041dad3ac40
SHA1 hash: 99d22eb0fb1b231184bde7b1e8da866c4ef92d0c
MD5 hash: e8be24aa25aadd26d1553362b154fff3
humanhash: spring-oscar-iowa-cold
File name:BG58FINV915010BGNBRKTF_20260728.PDF
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'647'616 bytes
First seen:2026-08-04 08:03:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'131 x AgentTesla, 20'159 x Formbook, 12'362 x SnakeKeylogger)
ssdeep 49152:9UsE0XMiGJxw5kOVwflkEEt7ER9Pj6k9:9PEaMiGJxw5jVqlkPtUV6m
TLSH T1A17522846602C926CA5107341AB1F3F6173D1DDCA101E2239FE9FDEBBA7AE516D842D3
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe pdf PureLogsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/2b48c6cc-05fc-411c-8a4a-2a72cc5a04e4/
Malware family:
n/a
ID:
1
File name:
INV_1K26TBB_00260004_30072026.PDF.gz
Verdict:
Suspicious activity
Analysis date:
2026-07-30 21:58:18 UTC
Tags:
arch-exec netreactor
Link:
https://app.any.run/tasks/ee274089-292d-4f4c-b5cc-bc2b44d563ad

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/78751/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
formbook masquerade packed
Link:
https://www.filescan.io/uploads/6a719d1864f11866e09e04ab/reports/1adc8e01-05e3-41f9-a6d5-86d91ac242b8/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/089c6fa1bc4e09739b603b68c412885ea7818339364f27a41f1b2e250e7fdb8c
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-29T23:57:00Z UTC
Last seen:
2026-08-06T05:58:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/089c6fa1bc4e09739b603b68c412885ea7818339364f27a41f1b2e250e7fdb8c/results?tab=lookup
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d55acc68-d23c-4c58-8993-2df390ee3eae
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1951757
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AntiVM3
Yara detected MSIL Injector
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/089c6fa1bc4e09739b603b68c412885ea7818339364f27a41f1b2e250e7fdb8c
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.28 Win 32 Exe x86
Link:
https://app.malva.re/file/e8be24aa25aadd26d1553362b154fff3
Detection:
purelogs
Create hunting rule
Link:
https://mwdb.cert.pl/sample/089c6fa1bc4e09739b603b68c412885ea7818339364f27a41f1b2e250e7fdb8c/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-07-30 12:58:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bcog7in4jyexhg3ahnumieuil2tydazzgzhspja7dmxckdt73oga._file
Verdict:
malicious
Label(s):
PureCrypter
Create hunting rule
Link:
https://reports.threatray.com/057365e8-a59c-4571-8477-4a3eacc93959
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/260804-jyf76sfg47/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
089c6fa1bc4e09739b603b68c412885ea7818339364f27a41f1b2e250e7fdb8c
MD5 hash:
e8be24aa25aadd26d1553362b154fff3
SHA1 hash:
99d22eb0fb1b231184bde7b1e8da866c4ef92d0c
Link:
https://www.unpac.me/results/0ca5d019-1dd2-49fb-8eda-4abd582f111a/
SH256 hash:
5a68af927fbd341968ca5b0670560ad3a23e8810107fe12daac156b379a45b65
MD5 hash:
ab584a5ad9675bd3d802c89925b93778
SHA1 hash:
373dcc04df4eac292f55fe7bda4cb91284cff489
Link:
https://www.unpac.me/results/0ca5d019-1dd2-49fb-8eda-4abd582f111a/
SH256 hash:
6d4c5bc731b2e23fa90f0d8e916c17f57c4bf3d38278b1d02bb560cb19b85091
MD5 hash:
cd2fd8822f142d3a5f9d51f58967a218
SHA1 hash:
7d83a73965e5cdba3ecf738e3794804d3c98f8c0
Link:
https://www.unpac.me/results/0ca5d019-1dd2-49fb-8eda-4abd582f111a/
SH256 hash:
05b47096e8601adeb3636458ac0e8010ac18476371f23700a7bc633e5b5f417b
MD5 hash:
29ad0cb52996e26758067627ac1ad2bf
SHA1 hash:
c3478be1eae145eb7b83f50cb6e8a09d86e30b2a
Link:
https://www.unpac.me/results/0ca5d019-1dd2-49fb-8eda-4abd582f111a/
SH256 hash:
90285527c435838d9aaeb19c6be55bc328aef5500eef4fbb8324df55d055fb28
MD5 hash:
40955d64bb586f08ba72ddb853d088ba
SHA1 hash:
5e6c72e46d047e3f2367160c057c58ddaafa9b5a
Link:
https://www.unpac.me/results/0ca5d019-1dd2-49fb-8eda-4abd582f111a/
SH256 hash:
8b3e9ac8dba7c2ded10d97dcb1317c1997378bf8d065ac3586800b5a03ff9ae4
MD5 hash:
c1df96d8b5647a7d1b6cb0ed0bf57379
SHA1 hash:
edb5409404406c15b59a31f8991604dce2cf7bd2
Link:
https://www.unpac.me/results/0ca5d019-1dd2-49fb-8eda-4abd582f111a/
SH256 hash:
a13167da77d714045be1222e4bfe5d9a01dfc04214234532a08f1d598bfec3d6
MD5 hash:
90a1145708b52cd8d9e383c99352bfde
SHA1 hash:
f1f7b874f5667e12c6411aad5170f44b900bd2a4
Link:
https://www.unpac.me/results/0ca5d019-1dd2-49fb-8eda-4abd582f111a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/089c6fa1bc4e09739b603b68c412885ea7818339364f27a41f1b2e250e7fdb8c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/78751/

Comments