MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2478e8fdad997076bed0cb36bd3a523edae4a314e2b1b7c28e867c72a67fe2d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2478e8fdad997076bed0cb36bd3a523edae4a314e2b1b7c28e867c72a67fe2d1
SHA3-384 hash:	74422a2b742cf1f5f71b94d2e739292a6bfbc9b4a9942bcdbe41551e5be20d7d40d2f864e13f5ad592cc645c87872d47
SHA1 hash:	fa0e0bc8ea428c22c188c12d189422078afab4be
MD5 hash:	7af43e69251cc5218cab301b5f085012
humanhash:	lithium-leopard-pip-vermont
File name:	NEWXPOX36732011.rar
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	285'025 bytes
First seen:	2026-07-03 18:01:10 UTC
Last seen:	2026-07-03 18:01:14 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:ZRtF6ogOrJaPYhYamCO/BFw3jI4gnIclLjlcKckxXFvRaiNARGpa:ZJb4jLCO5Fw3B2IkKKXXFv4kFa
TLSH	T155541392EB4444D09EB9D15DBB7725C02B1FF727EEC11EA6E28731A7260B3C464F0A64
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	PureLogsStealer rar

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

47

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	NEW PO 36732011.js
File size:	1'999'224 bytes
SHA256 hash:	c9a756a44b62f66d5b69a8ad643a52f14f9bbbe6f1aba92399e127537774f1e2
MD5 hash:	941a7b02fd34dea11487ddc4e1086a6b
MIME type:	text/plain
Signature	PureLogsStealer

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/1260b8cf-ed9e-47bc-acc8-9ba5d2e492ab/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Obfus-2662.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a4268411548daf709faf651

Tags:

obfuscate cryxos virus shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 conhost powershell repaired

Link:

https://www.filescan.io/uploads/6a47f9853ffd795b792d0569/reports/29f6f903-e4e8-4c9d-b195-bd4858b8f03a/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2478e8fdad997076bed0cb36bd3a523edae4a314e2b1b7c28e867c72a67fe2d1

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-24T16:58:00Z UTC

Last seen:

2026-06-27T15:39:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2478e8fdad997076bed0cb36bd3a523edae4a314e2b1b7c28e867c72a67fe2d1/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/7af43e69251cc5218cab301b5f085012

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2478e8fdad997076bed0cb36bd3a523edae4a314e2b1b7c28e867c72a67fe2d1/

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-24 06:19:37 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

12 of 36 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=er4or7nntfyhnpwqzm3l2ossh3nojiyu4ky3pquoqz6hfjt74liq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2478e8fdad997076bed0cb36bd3a523edae4a314e2b1b7c28e867c72a67fe2d1