🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ba40408b9f9d72edf4b49eeeb45ebbf75cf418117c13475891cc74d7c528e57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ba40408b9f9d72edf4b49eeeb45ebbf75cf418117c13475891cc74d7c528e57
SHA3-384 hash: 0e130bb78d212117dffb333b1e0cda1dbb5a993cd30073a05fd862c3105559af8d790a8d61e13876cb0d6630fc02f447
SHA1 hash: 58af5c2fa7fc3b0381bbbb301dd0fc3f4b0f79d2
MD5 hash: 4362d311bec22b4841e45274cb7306c2
humanhash: bravo-sixteen-victor-uranus
File name:8700003811_MGK_DEL2_pdf.js
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'463'821 bytes
First seen:2026-09-17 13:32:22 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:/oZojT8Tvw2nkIlJ9TmDOGjzi0ujm53gsoClq6iLHQoUqOcxA/6PD9n5WTIg9hxo:/Snk8zqDhL53XvWNTr8K
TLSH T135651218946939B507BC8F6ADF636C0736309D80755FE5DA830B62861E8B7B3AFD2C11
Magika batch
Reporter abuse_ch
Tags:js PureLogsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BAT.Starter.776.13806.24749.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
attrib masquerade obfuscated powershell repaired
Link:
https://www.filescan.io/uploads/6aabec1bfb3fbf74b707de06/reports/66e31534-de75-4325-b295-39efa279ae42/overview
Verdict:
Suspicious
Labled as:
JS/Obfuscated.CQ trojan
Link:
https://www.hybrid-analysis.com/sample/0ba40408b9f9d72edf4b49eeeb45ebbf75cf418117c13475891cc74d7c528e57
Verdict:
Malicious
File Type:
js
First seen:
2026-09-17T10:44:00Z UTC
Last seen:
2026-09-19T09:55:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic Backdoor.Win64.PsC2.sb Trojan.JS.SAgent.sb HEUR:Trojan.Script.SAgent.gen HEUR:Trojan.BAT.Alien.gen
Link:
https://opentip.kaspersky.com/0ba40408b9f9d72edf4b49eeeb45ebbf75cf418117c13475891cc74d7c528e57/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1974258
Signature
Creates a thread in another existing process (thread injection)
Found suspicious powershell code related to unpacking or dynamic code loading
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Uses attrib.exe to hide files
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1974258 Sample: 8700003811_MGK_DEL2_pdf.js Startdate: 17/09/2026 Architecture: WINDOWS Score: 100 102 Malicious sample detected (through community Yara rule) 2->102 104 Sigma detected: WScript or CScript Dropper 2->104 106 Joe Sandbox ML detected suspicious sample 2->106 11 wscript.exe 1 1 2->11         started        14 svchost.exe 2->14         started        process3 dnsIp4 108 JScript performs obfuscated calls to suspicious functions 11->108 110 Wscript starts Powershell (via cmd or directly) 11->110 112 Windows Scripting host queries suspicious COM object (likely to drop second stage) 11->112 114 2 other signatures 11->114 17 cmd.exe 1 11->17         started        20 powershell.exe 8 11->20         started        72 127.0.0.1 unknown unknown 14->72 signatures5 process6 file7 80 Wscript starts Powershell (via cmd or directly) 17->80 82 Uses attrib.exe to hide files 17->82 23 powershell.exe 17->23         started        25 cmd.exe 1 17->25         started        27 cmd.exe 1 17->27         started        31 7 other processes 17->31 66 C:\Users\user\AppData\...\10563255794071.cmd, DOS 20->66 dropped 84 Found suspicious powershell code related to unpacking or dynamic code loading 20->84 29 conhost.exe 20->29         started        signatures8 process9 process10 33 powershell.exe 28 23->33         started        36 findstr.exe 1 25->36         started        38 findstr.exe 1 27->38         started        40 findstr.exe 1 31->40         started        42 findstr.exe 1 31->42         started        44 findstr.exe 1 31->44         started        46 findstr.exe 1 31->46         started        signatures11 86 Hijacks the control flow in another process 33->86 88 Writes to foreign memory regions 33->88 90 Maps a DLL or memory area into another process 33->90 92 2 other signatures 33->92 48 choice.exe 14 6 33->48         started        52 conhost.exe 33->52         started        process12 dnsIp13 68 89.106.83.156, 49745, 49746, 49749 HOSTERAM Germany 48->68 94 Tries to harvest and steal browser information (history, passwords, etc) 48->94 96 Writes to foreign memory regions 48->96 98 Creates a thread in another existing process (thread injection) 48->98 100 2 other signatures 48->100 54 chrome.exe 48->54         started        57 conhost.exe 48->57         started        59 chrome.exe 48->59 injected 61 6 other processes 48->61 signatures14 process15 dnsIp16 70 192.168.2.5, 138, 443, 49641 unknown unknown 54->70 63 chrome.exe 54->63         started        process17 dnsIp18 74 www.google.com 142.251.152.119, 443, 49770, 49773 GOOGLE-GoogleLLCUS United States 63->74 76 googlehosted.l.googleusercontent.com 172.217.75.132, 443, 49777 GOOGLE-GoogleLLCUS United States 63->76 78 5 other IPs or domains 63->78
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0ba40408b9f9d72edf4b49eeeb45ebbf75cf418117c13475891cc74d7c528e57
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ba40408b9f9d72edf4b49eeeb45ebbf75cf418117c13475891cc74d7c528e57/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2026-09-17 13:33:18 UTC
File Type:
Text (Batch)
AV detection:
7 of 23 (30.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bosaicfz7hls5x2ljhxowrplx5246qmbc7ati5mjdtdu27csrzlq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection defense_evasion discovery execution
Link:
https://tria.ge/reports/260917-qtm89a1gja/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Views/modifies file attributes
outlook_office_path
outlook_win_path
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Executes a command shell one-liner
System Time Discovery
Hide Artifacts: Hidden Files and Directories
Accesses Microsoft Outlook profiles
Checks computer location settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0ba40408b9f9d72edf4b49eeeb45ebbf75cf418117c13475891cc74d7c528e57

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments