🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 194afd90c61ee98e9d25707de366c100381e4efabc0e4fb4ad2bd2a6cc9b1542. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 18


Intelligence 18 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 194afd90c61ee98e9d25707de366c100381e4efabc0e4fb4ad2bd2a6cc9b1542
SHA3-384 hash: b71fccea48088caa48950954fa8dc5f7bdce804db5f4933c2c36689c6b3e6f1812e2718547d9105a3e424febd9f6bf06
SHA1 hash: 955543925fbdd134b942e9bd8d0e1f53d7ec1f5d
MD5 hash: 9722eff49249da69482e4e60a0140d54
humanhash: maine-washington-tennessee-west
File name:194afd90c61ee98e9d25707de366c100381e4efabc0e4fb4ad2bd2a6cc9b1542
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:2'038'272 bytes
First seen:2026-11-06 11:41:46 UTC
Last seen:2026-11-06 12:35:29 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'359 x AgentTesla, 20'862 x Formbook, 12'418 x SnakeKeylogger)
ssdeep 49152:V+oBLquN3Al0p5ij947I80Pu0xMI7ikc+dI+Khv:MoBLHDUR47Tiu0xMZkc+KZ
TLSH T1A495F11217F88225F2FF5731747188528AF9FA167872E78C1D88519D1EB3B92D9A03B3
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe PureLogsStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
210
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
194afd90c61ee98e9d25707de366c100381e4efabc0e4fb4ad2bd2a6cc9b1542
Verdict:
Malicious activity
Analysis date:
2026-11-06 11:41:06 UTC
Tags:
netreactor stealer babel
Link:
https://app.any.run/tasks/5b24839e-6632-431b-b588-9dbbab693423

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97618/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aedbd15c7a14f3384d27475
Tags:
adapter ordin virus lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Deleting a recently created file
Launching a process
Creating synchronization primitives
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 finger lolbin packed squirrel
Link:
https://www.filescan.io/uploads/6aedbd1357e4b552755a51d3/reports/542ce829-5fbc-440a-8724-74ab67588b1c/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/194afd90c61ee98e9d25707de366c100381e4efabc0e4fb4ad2bd2a6cc9b1542
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-26T03:44:00Z UTC
Last seen:
2026-11-04T08:29:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/194afd90c61ee98e9d25707de366c100381e4efabc0e4fb4ad2bd2a6cc9b1542/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/062910e5-462f-4c53-b835-c0f083f45473
Result
Threat name:
PureLogs Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1999729
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected MSIL Injector
Yara detected PureLogs Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1999729 Sample: 7u3WZDjjZB.exe Startdate: 06/11/2026 Architecture: WINDOWS Score: 100 32 mr-b01.tm-azurefd.net 2->32 34 eip-terr-na.cdp1.digicert.com.akahost.net 2->34 36 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->36 48 Antivirus / Scanner detection for submitted sample 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Yara detected PureLogs Stealer 2->52 54 5 other signatures 2->54 10 7u3WZDjjZB.exe 14 2->10         started        signatures3 process4 file5 30 C:\Users\user\AppData\...\7u3WZDjjZB.exe.log, CSV 10->30 dropped 56 Found many strings related to Crypto-Wallets (likely being stolen) 10->56 58 Writes to foreign memory regions 10->58 60 Allocates memory in foreign processes 10->60 62 Injects a PE file into a foreign processes 10->62 14 MSBuild.exe 15 4 10->14         started        signatures6 process7 dnsIp8 46 155.103.69.184, 49714, 49722, 49723 WHITELABELUS Turkey 14->46 64 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->64 66 Tries to steal Mail credentials (via file / registry access) 14->66 68 Found many strings related to Crypto-Wallets (likely being stolen) 14->68 70 9 other signatures 14->70 18 chrome.exe 1 14->18         started        signatures9 process10 dnsIp11 38 192.168.2.6, 138, 443, 49706 unknown unknown 18->38 21 chrome.exe 18->21         started        24 chrome.exe 2 18->24 injected 26 chrome.exe 18->26 injected process12 dnsIp13 40 www.google.com 142.251.151.119, 443, 49727, 49731 GOOGLE-GoogleLLCUS United States 21->40 42 play.google.com 142.251.156.7, 443, 49744 GOOGLE-GoogleLLCUS United States 21->42 44 5 other IPs or domains 21->44 28 WerFault.exe 16 24->28         started        process14
Verdict:
inconclusive
YARA:
12 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.24 Win 32 Exe x86
Link:
https://app.malva.re/file/9722eff49249da69482e4e60a0140d54
Detection:
purelogs
Create hunting rule
Link:
https://mwdb.cert.pl/sample/194afd90c61ee98e9d25707de366c100381e4efabc0e4fb4ad2bd2a6cc9b1542/
Threat name:
ByteCode-MSIL.Trojan.PureLogs
Create hunting rule
Status:
Malicious
First seen:
2026-10-26 11:32:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dffp3eggd3uy5hjfob66gzwbaa4b4tx2xqhe7nfnfpjknte3cvba._file
Verdict:
malicious
Label(s):
PureHVNC
Create hunting rule
Link:
https://reports.threatray.com/40f6afc6-e817-4f5d-9ede-862c092507ef
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/261106-nt3mtsbs2w/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
System Time Discovery
Suspicious use of SetThreadContext
Malware Family:
n/a
Verdict:
Malicious
Tags:
injector rat evasion stealer
YARA:
n/a
Link:
https://app.threat.zone/submission/74c40d81-d4b4-42c0-995e-3a975fa9bb52
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
dotnet
Link:
https://intel.virussign.com/intelligence/file/194afd90c61ee98e9d25707de366c100381e4efabc0e4fb4ad2bd2a6cc9b1542
Unpacked files
SH256 hash:
194afd90c61ee98e9d25707de366c100381e4efabc0e4fb4ad2bd2a6cc9b1542
MD5 hash:
9722eff49249da69482e4e60a0140d54
SHA1 hash:
955543925fbdd134b942e9bd8d0e1f53d7ec1f5d
Link:
https://www.unpac.me/results/a0fae73a-56f0-4e58-89c4-d1b2013b9981/
SH256 hash:
79d325e851223df15dedabc32c557e809c4b5401e8224a7ca3e9d4c26f2c342e
MD5 hash:
68544db218959b4c24f3ef1e2ef6d9c1
SHA1 hash:
24a8f4dccdd298196e232e1db4e8124717d888a1
Link:
https://www.unpac.me/results/a0fae73a-56f0-4e58-89c4-d1b2013b9981/
SH256 hash:
77ec88c737bf799d0d1f94159e62a8b48ac4d69112fa9d888b468bef2bca8566
MD5 hash:
1c1f35def9838c8879f33f30235d6afe
SHA1 hash:
363fcf894f4b37c60c4f19bea9c189f85c9d53b0
Link:
https://www.unpac.me/results/a0fae73a-56f0-4e58-89c4-d1b2013b9981/
SH256 hash:
ab33a7ed55467a46afdafe8f9cbaa76a78c6ee32a4f29dcd57f35cc1afe80cbd
MD5 hash:
1f283ca89e21972b9eb6ae9f0fba7cd0
SHA1 hash:
4cae2f91eb40dd14e7445e74b22771ae8c51720f
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/a0fae73a-56f0-4e58-89c4-d1b2013b9981/
SH256 hash:
f7645d16a218c9d006536f7e90673867ce88a1ad5335b3283962fb6afc88d084
MD5 hash:
fa898c65984493bc0d82ecd1a4447985
SHA1 hash:
2ac1b1a1da41d76ec7cb9bbb6610b5cbb77f8685
Link:
https://www.unpac.me/results/a0fae73a-56f0-4e58-89c4-d1b2013b9981/
SH256 hash:
b5756637c05f80f039f2baa1ae14f82428bf401286230c562e6bf43ed2f41e4d
MD5 hash:
f5658c1f50a830622f7e74aa51af8562
SHA1 hash:
46fa8f68968ba1ae607cff284bf772c603fba39d
Link:
https://www.unpac.me/results/a0fae73a-56f0-4e58-89c4-d1b2013b9981/
SH256 hash:
8479001cc7b626942a3b113f94288135130eea8ff689760b98793dee421bc664
MD5 hash:
f0c942cc473000d4168a42676edf781b
SHA1 hash:
99bffb2931d3f5c2641fdad53a5120607dcc5b8c
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/a0fae73a-56f0-4e58-89c4-d1b2013b9981/
Malware family:
PureRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/194afd90c61e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/194afd90c61ee98e9d25707de366c100381e4efabc0e4fb4ad2bd2a6cc9b1542

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/97618/

Comments