MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2988bb5811ea625948d61f441d45bffb97e4dd7cd48321c85daad62e802bce5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2988bb5811ea625948d61f441d45bffb97e4dd7cd48321c85daad62e802bce5f
SHA3-384 hash: 9995eb3309bef2ebd007262c36c87336581db9ff938effa8b1e4ebdcb30c505c116ef20cd1a923a375c3da2d1b5ddab2
SHA1 hash: d8add06c02ecda277c0e03fb3afb6063787e190f
MD5 hash: c24d3ed376a4dca1fe6bde6c42aed3c6
humanhash: mango-tango-juliet-double
File name:INV_1K26TBB_00260004_30072026.PDF
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'657'344 bytes
First seen:2026-08-04 08:05:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'192 x AgentTesla, 20'342 x Formbook, 12'365 x SnakeKeylogger)
ssdeep 49152:lJTSpLnn8FFkByO7y002bEwX6Q/0rrUs:vTwnnAmD02tXRMP
TLSH T1687523582A0AC617C9A547344E76F2F5673C5ED8D511C217AFFCBDEFB9AAE244C00282
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe pdf PureLogsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/3d8f455d-6424-4030-a521-67eae57d7439/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-08-04 08:09:05 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/a197b1e1-5c6c-4ed9-9cb4-45c222f6673f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/78752/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/6a719e7db1740d9dd3cc2de8/reports/89f8ad2c-d40a-4cdb-a8c4-78ec99603711/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/2988bb5811ea625948d61f441d45bffb97e4dd7cd48321c85daad62e802bce5f
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-29T19:46:00Z UTC
Last seen:
2026-08-06T05:47:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/2988bb5811ea625948d61f441d45bffb97e4dd7cd48321c85daad62e802bce5f/results?tab=lookup
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/19364df4-9814-46f3-a4d9-7420006466fb
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1951756
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AntiVM3
Yara detected MSIL Injector
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2988bb5811ea625948d61f441d45bffb97e4dd7cd48321c85daad62e802bce5f
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.28 Win 32 Exe x86
Link:
https://app.malva.re/file/c24d3ed376a4dca1fe6bde6c42aed3c6
Detection:
purelogs
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2988bb5811ea625948d61f441d45bffb97e4dd7cd48321c85daad62e802bce5f/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-07-30 01:01:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fgelwwar5jrfssgwd5cb2rn77ol6jxl42sbsdsc5vllc5ablzzpq._file
Verdict:
malicious
Label(s):
PureCrypter
Create hunting rule
Link:
https://reports.threatray.com/7cf05585-9362-48ba-8233-de7648a76508
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/260804-jzlt2sap2z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
2988bb5811ea625948d61f441d45bffb97e4dd7cd48321c85daad62e802bce5f
MD5 hash:
c24d3ed376a4dca1fe6bde6c42aed3c6
SHA1 hash:
d8add06c02ecda277c0e03fb3afb6063787e190f
Link:
https://www.unpac.me/results/6a7213ea-3396-4713-b3ee-9de4fd8ceb02/
SH256 hash:
36e1dcc3ecf08021422155623c21e3b94a71ef1c33c36afdeae06e03e8c2321d
MD5 hash:
14b7d2562449bb21074a378cf537c150
SHA1 hash:
228a4405fbecbe367db14f50dd026d3b8077529b
Link:
https://www.unpac.me/results/6a7213ea-3396-4713-b3ee-9de4fd8ceb02/
SH256 hash:
6d4c5bc731b2e23fa90f0d8e916c17f57c4bf3d38278b1d02bb560cb19b85091
MD5 hash:
cd2fd8822f142d3a5f9d51f58967a218
SHA1 hash:
7d83a73965e5cdba3ecf738e3794804d3c98f8c0
Link:
https://www.unpac.me/results/6a7213ea-3396-4713-b3ee-9de4fd8ceb02/
SH256 hash:
05b47096e8601adeb3636458ac0e8010ac18476371f23700a7bc633e5b5f417b
MD5 hash:
29ad0cb52996e26758067627ac1ad2bf
SHA1 hash:
c3478be1eae145eb7b83f50cb6e8a09d86e30b2a
Link:
https://www.unpac.me/results/6a7213ea-3396-4713-b3ee-9de4fd8ceb02/
SH256 hash:
95dafd841e0b431deb0420427e0d17391942c49fd9267575af54bce2780fd8d3
MD5 hash:
a686db055d1ac6813594cc01e6bfcb35
SHA1 hash:
68f96c1ac9bf4a0e41e1d6326ea46cc70f36ec0e
Link:
https://www.unpac.me/results/6a7213ea-3396-4713-b3ee-9de4fd8ceb02/
SH256 hash:
8b3e9ac8dba7c2ded10d97dcb1317c1997378bf8d065ac3586800b5a03ff9ae4
MD5 hash:
c1df96d8b5647a7d1b6cb0ed0bf57379
SHA1 hash:
edb5409404406c15b59a31f8991604dce2cf7bd2
Link:
https://www.unpac.me/results/6a7213ea-3396-4713-b3ee-9de4fd8ceb02/
SH256 hash:
a13167da77d714045be1222e4bfe5d9a01dfc04214234532a08f1d598bfec3d6
MD5 hash:
90a1145708b52cd8d9e383c99352bfde
SHA1 hash:
f1f7b874f5667e12c6411aad5170f44b900bd2a4
Link:
https://www.unpac.me/results/6a7213ea-3396-4713-b3ee-9de4fd8ceb02/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2988bb5811ea/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/2988bb5811ea625948d61f441d45bffb97e4dd7cd48321c85daad62e802bce5f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/78752/

Comments