🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2865456cb397aad9936aa001ea6a1d80b65862665c0e8a44dba7edda0c7e7589. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2865456cb397aad9936aa001ea6a1d80b65862665c0e8a44dba7edda0c7e7589
SHA3-384 hash: 3fbf0b530910f6ac2a03e25bfca67e22ce13f335b7b50bd0887e4f81b0bfc28547e6b406e7eaa81a67a2478dda0c32d0
SHA1 hash: cfe8e8c12cf9aab112493a79eaee178cda83faa4
MD5 hash: 23efafd665e702da82193bf1bc5e630d
humanhash: diet-finch-lamp-sierra
File name:23efafd665e702da82193bf1bc5e630d.exe
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'578'496 bytes
First seen:2026-08-04 08:03:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'204 x AgentTesla, 20'374 x Formbook, 12'365 x SnakeKeylogger)
ssdeep 49152:Bz9CzEUFiuBWi/VLdKinBF8miEAyrNo+NA:Bkz/zBWi/LKinBmmiEAyrNo+NA
TLSH T17075236A6269FF01D7AB5BF959B5E1716FB42C8E6521C3808FD92CFFB569B100A00703
TrID 72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.4% (.EXE) Win64 Executable (generic) (6522/11/2)
4.4% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter abuse_ch
Tags:exe PureLogsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c394029e-c555-4136-96da-d5b94f5ad498/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-08-04 08:16:35 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/89ffb3c9-ff7e-49ff-9296-a94d3c3e7385

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/78750/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 krypt packed
Link:
https://www.filescan.io/uploads/6a719d2cbae3580c1852a70b/reports/1dffe27a-d9db-4823-a730-f8c7892edad3/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/2865456cb397aad9936aa001ea6a1d80b65862665c0e8a44dba7edda0c7e7589
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-27T11:56:00Z UTC
Last seen:
2026-08-06T05:57:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/2865456cb397aad9936aa001ea6a1d80b65862665c0e8a44dba7edda0c7e7589/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d935f696-7a12-4c77-95cd-d0b06ab41092
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1951758
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected MSIL Injector
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2865456cb397aad9936aa001ea6a1d80b65862665c0e8a44dba7edda0c7e7589
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.60 Win 32 Exe x86
Link:
https://app.malva.re/file/23efafd665e702da82193bf1bc5e630d
Detection:
purelogs
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2865456cb397aad9936aa001ea6a1d80b65862665c0e8a44dba7edda0c7e7589/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-07-29 12:02:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fbsuk3fts6vnte3kuaa6u2q5qc3fqytglqhiurg3u7w5udd6oweq._file
Verdict:
malicious
Label(s):
PureCrypter
Create hunting rule
Link:
https://reports.threatray.com/5b5d85e7-15f8-4a57-a1ea-f8823d589b6e
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/260804-jyflmsfg45/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
2865456cb397aad9936aa001ea6a1d80b65862665c0e8a44dba7edda0c7e7589
MD5 hash:
23efafd665e702da82193bf1bc5e630d
SHA1 hash:
cfe8e8c12cf9aab112493a79eaee178cda83faa4
Link:
https://www.unpac.me/results/61e5bc9c-1732-41f8-9f96-2c0763f47c35/
SH256 hash:
aad986261bd7745133cfaf47cb8089686fb69f8fc3397bdff467d7501dd7ee52
MD5 hash:
b56636fea1a0a3d5fbd707a266b00109
SHA1 hash:
2510197bfa12f65e651913333be34fed53908a95
Link:
https://www.unpac.me/results/61e5bc9c-1732-41f8-9f96-2c0763f47c35/
SH256 hash:
05b47096e8601adeb3636458ac0e8010ac18476371f23700a7bc633e5b5f417b
MD5 hash:
29ad0cb52996e26758067627ac1ad2bf
SHA1 hash:
c3478be1eae145eb7b83f50cb6e8a09d86e30b2a
Link:
https://www.unpac.me/results/61e5bc9c-1732-41f8-9f96-2c0763f47c35/
SH256 hash:
47a856ff7d9bf14949f9a1deed4ba4ec9495a9ef95ee41ba6d78f630561d166c
MD5 hash:
332b4cd85d1b878f5c5bf709b5984644
SHA1 hash:
ddba69ce01e7ea28029d271d4dd2f75bc3bf454f
Link:
https://www.unpac.me/results/61e5bc9c-1732-41f8-9f96-2c0763f47c35/
SH256 hash:
983ed02c2a309b9ca0288adf318536b8eae4ac6c4746b61768f52840e0aafd73
MD5 hash:
c5867c55299e10cfef465e450fc35688
SHA1 hash:
800b4460b5ebc6b5981e46a1da59a38263ae7ea4
Link:
https://www.unpac.me/results/61e5bc9c-1732-41f8-9f96-2c0763f47c35/
SH256 hash:
8b3e9ac8dba7c2ded10d97dcb1317c1997378bf8d065ac3586800b5a03ff9ae4
MD5 hash:
c1df96d8b5647a7d1b6cb0ed0bf57379
SHA1 hash:
edb5409404406c15b59a31f8991604dce2cf7bd2
Link:
https://www.unpac.me/results/61e5bc9c-1732-41f8-9f96-2c0763f47c35/
SH256 hash:
a13167da77d714045be1222e4bfe5d9a01dfc04214234532a08f1d598bfec3d6
MD5 hash:
90a1145708b52cd8d9e383c99352bfde
SHA1 hash:
f1f7b874f5667e12c6411aad5170f44b900bd2a4
Link:
https://www.unpac.me/results/61e5bc9c-1732-41f8-9f96-2c0763f47c35/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2865456cb397aad9936aa001ea6a1d80b65862665c0e8a44dba7edda0c7e7589

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/78750/

Comments