MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22929fd615674a4e46fa8d2f845b19675d0328c687a136cd847a1f2411dd84d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22929fd615674a4e46fa8d2f845b19675d0328c687a136cd847a1f2411dd84d4
SHA3-384 hash: 75b1383a9ca89c7c7582edd8a52cacb9b84fa09ac9fa1f861e93e5738938c737b5ee1429e155695734835e39373ed451
SHA1 hash: 289ca4cc16975ca20a024738587fc7b8a345ce32
MD5 hash: e9a760bdd778e40a7ec3aa6d9e9861cc
humanhash: mobile-salami-july-happy
File name:57008369310.pdf
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'584'128 bytes
First seen:2026-07-16 06:43:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'116 x AgentTesla, 20'118 x Formbook, 12'358 x SnakeKeylogger)
ssdeep 24576:vrWJTM4XPk75bGqtlgjKOTP4/kKq21xldge/Vv7c1czsPBKelcynMyTJCi5:vrAPXPk75bG+CJP4M0D9bsMeCqMKJ
Threatray 44 similar samples on MalwareBazaar
TLSH T11B7523AC5452FA12CE981BB857A4F2B267BD0DAA3400D152CFCDBFEBFD657184C58092
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe pdf PureLogsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/dea8ddab-266d-4390-bbeb-af20899c2f1a/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74865/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.69536967.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a587da0b3055706bb5568c5
Tags:
underscore extens micro spawn
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
dropper masquerade packed
Link:
https://www.filescan.io/uploads/6a587d967190d6a3ddbd9897/reports/a01d5d37-a966-4a67-86ef-635e03ac5c93/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/22929fd615674a4e46fa8d2f845b19675d0328c687a136cd847a1f2411dd84d4
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-15T12:13:00Z UTC
Last seen:
2026-07-18T01:58:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/22929fd615674a4e46fa8d2f845b19675d0328c687a136cd847a1f2411dd84d4/results?tab=lookup
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/35ac2bc6-5ecb-4528-9e95-1485fb5bee83
Result
Threat name:
PureLogs Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1943310
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected MSIL Injector
Yara detected PureLogs Stealer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1943310 Sample: 57008369310.pdf.exe Startdate: 16/07/2026 Architecture: WINDOWS Score: 100 52 Antivirus / Scanner detection for submitted sample 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 Yara detected PureLogs Stealer 2->56 58 8 other signatures 2->58 8 57008369310.pdf.exe 3 2->8         started        12 57008369310.pdf.exe 2 2->12         started        process3 file4 34 C:\Users\user\...\57008369310.pdf.exe.log, ASCII 8->34 dropped 60 Found many strings related to Crypto-Wallets (likely being stolen) 8->60 62 Switches to a custom stack to bypass stack traces 8->62 64 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 8->64 14 57008369310.pdf.exe 15 5 8->14         started        66 Injects a PE file into a foreign processes 12->66 18 57008369310.pdf.exe 4 12->18         started        signatures5 process6 dnsIp7 50 64.89.160.76, 49704, 49711, 49712 GHOSTYNETWORKSUS Luxembourg 14->50 68 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->68 70 Tries to steal Mail credentials (via file / registry access) 14->70 72 Found many strings related to Crypto-Wallets (likely being stolen) 14->72 80 4 other signatures 14->80 20 chrome.exe 1 14->20         started        22 chrome.exe 2 14->22 injected 74 Tries to harvest and steal browser information (history, passwords, etc) 18->74 76 Writes to foreign memory regions 18->76 78 Allocates memory in foreign processes 18->78 24 chrome.exe 18->24         started        27 chrome.exe 18->27 injected signatures8 process9 dnsIp10 29 chrome.exe 20->29         started        36 192.168.2.6, 138, 443, 49206 unknown unknown 24->36 32 chrome.exe 24->32         started        process11 dnsIp12 38 www.google.com 142.251.152.119, 443, 49713, 49716 GOOGLE-GoogleLLCUS United States 29->38 40 ogads-pa.clients6.google.com 142.251.167.95, 443, 49730, 49731 GOOGLE-GoogleLLCUS United States 29->40 46 2 other IPs or domains 29->46 42 142.251.156.119, 443, 49742, 49744 GOOGLE-GoogleLLCUS United States 32->42 44 64.233.180.132, 443, 49753 GOOGLE-GoogleLLCUS United States 32->44 48 5 other IPs or domains 32->48
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/22929fd615674a4e46fa8d2f845b19675d0328c687a136cd847a1f2411dd84d4
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.34 Win 32 Exe x86
Link:
https://app.malva.re/file/e9a760bdd778e40a7ec3aa6d9e9861cc
Detection:
purelogs
Create hunting rule
Link:
https://mwdb.cert.pl/sample/22929fd615674a4e46fa8d2f845b19675d0328c687a136cd847a1f2411dd84d4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2026-07-16 01:07:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ekjj7vqvm5fe4rx2ruxyiwyzm5oqgkggq6qtntmepipsieo5qtka._file
Verdict:
malicious
Label(s):
purecrypter
Create hunting rule
xworm
Create hunting rule
Similar samples:
13c2a9cc1c290c3ede00c01dff7f3ff5164054a55e74b46cd2a91de1791e08ab
PureLogsStealer
22929fd615674a4e46fa8d2f845b19675d0328c687a136cd847a1f2411dd84d4
PureLogsStealer
b366811f3f74717395eddf884e59b329cf192d2a310cf47deadbf4102ef71e67
PureLogsStealer
ba8fac34067f7e21e6fad69fbbd002e80cacda21fa07a8e82a5063bfda3ecc82
PureLogsStealer
c42130f2f9f1fc1a1c4189b6cc3bc5ce0207d21620e20cc4119ae86951105344
PureLogsStealer
dc6790cdf758ba93696edf19d490d1fbb59a4312d456c77a498ccf3b955e1572
PureLogsStealer
error
PureLogsStealer
fc6a7e49e66a4878755d3ef0c95236e3443c8a2bfe10a634d03660f543c3a038
PureLogsStealer
+ 34 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection discovery spyware stealer
Link:
https://tria.ge/reports/260716-hg74wsey3k/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Drops startup file
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
22929fd615674a4e46fa8d2f845b19675d0328c687a136cd847a1f2411dd84d4
MD5 hash:
e9a760bdd778e40a7ec3aa6d9e9861cc
SHA1 hash:
289ca4cc16975ca20a024738587fc7b8a345ce32
Link:
https://www.unpac.me/results/49a4b6b1-ee27-468e-98e2-b11f1b489bb9/
SH256 hash:
576024fd873e1a35619b32445e0831255d28123fc81f41189e6d49e4c00f36cc
MD5 hash:
5d084a7f45dad4bec002b9b175b15b97
SHA1 hash:
64a260000d162802dbc068826821ef9cb3dd9d2a
Link:
https://www.unpac.me/results/49a4b6b1-ee27-468e-98e2-b11f1b489bb9/
SH256 hash:
d033ca6f6fc6f56933921422663e7b4612ad0a9893fb58251851ccd743488ebf
MD5 hash:
e5596f079615003f522014b654e483d2
SHA1 hash:
83ff6339a634c88e887e09db7b27f1d6aed9bcc3
Link:
https://www.unpac.me/results/49a4b6b1-ee27-468e-98e2-b11f1b489bb9/
SH256 hash:
dd4ddcb93d369da8437b8f8f1386fec6a5b18251c94e0911c38540bb9a9fa280
MD5 hash:
d5a49cd6b89e6063ba408f9bfceae073
SHA1 hash:
e27b970a099864abf9190a5b26894ffb1e58e271
Link:
https://www.unpac.me/results/49a4b6b1-ee27-468e-98e2-b11f1b489bb9/
SH256 hash:
a22db6ddccb087305d3e91cebc45c844a087d725ac1649fb1a0f6983818790f5
MD5 hash:
20149ba9f971fb1da901e8cc4558775a
SHA1 hash:
1044a8da4b6eeda19a0007ae63b6188eafefb6c3
Link:
https://www.unpac.me/results/49a4b6b1-ee27-468e-98e2-b11f1b489bb9/
SH256 hash:
b2a66e9864f81c2800a5afef4bfd1faf7c910e5a43ea2eb9dbb15c8ab6ffc633
MD5 hash:
f0a13fb422cdb1f3ce667df897b5045b
SHA1 hash:
9b6566603e3a292482788924a83a1d94a9cd4627
Link:
https://www.unpac.me/results/49a4b6b1-ee27-468e-98e2-b11f1b489bb9/
SH256 hash:
8798a72056eaae576a5b6efea7cd5ee26d88c5ae2dfe9d8acda1dea9dcac9a61
MD5 hash:
ae5f749e99e51f7c23b8b6251f4a59f8
SHA1 hash:
cc7cbaa2ce659ea15cb550f3087d37c81291f248
Link:
https://www.unpac.me/results/49a4b6b1-ee27-468e-98e2-b11f1b489bb9/
Malware family:
PureRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/22929fd61567/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/22929fd615674a4e46fa8d2f845b19675d0328c687a136cd847a1f2411dd84d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/74865/

Comments