MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2eed7668091e52ef42e4df7e4c4847861426b7896fc36ddda43c20bdea107ede. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2eed7668091e52ef42e4df7e4c4847861426b7896fc36ddda43c20bdea107ede
SHA3-384 hash:	c3c6f8878a9c9ea13fc78a99f69daed00ac381b60ef31cf08fa2193beb8742436df013efee8e3b321bd7244bc1e578ca
SHA1 hash:	ea86f4444d1023ba681437643ffee1f44f597f88
MD5 hash:	e92c444e5acbbd6fcc925be4533030fe
humanhash:	lemon-seven-bacon-hotel
File name:	DE00239320032.001.rar
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	111'215 bytes
First seen:	2026-09-30 16:15:59 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	3072:2qszG4Y6wB85gjrVXzLieY77gsD4v72rl8gx:2qcFJwG+rJLugvJgx
TLSH	T18AB312C1DE7F07EAB34DADD8987CEE23969E54C3907C0C21660C271C1AE61B05AE7697
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	PureLogsStealer rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	kaufvertrag Volkswagen T6 Transporter DE00239320032.js
File size:	4'859'116 bytes
SHA256 hash:	b96f8cd6149f95feb16c5e62e267405876536ab531ce815879c54f082d8a992b
MD5 hash:	7202c581415b7c0aa9f2c20808eb88b3
MIME type:	text/plain
Signature	PureLogsStealer

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/80b35735-01fb-401b-9e85-e43a238541a4/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 evasive fingerprint loader powershell repaired

Link:

https://www.filescan.io/uploads/6abd35d1efa1a882e5fc16e3/reports/db8bfb47-4adb-4dc2-b26d-417c9bcc9a9a/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2eed7668091e52ef42e4df7e4c4847861426b7896fc36ddda43c20bdea107ede

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-09-30T14:36:00Z UTC

Last seen:

2026-09-30T14:51:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2eed7668091e52ef42e4df7e4c4847861426b7896fc36ddda43c20bdea107ede/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/e92c444e5acbbd6fcc925be4533030fe

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2eed7668091e52ef42e4df7e4c4847861426b7896fc36ddda43c20bdea107ede/

ReversingLabs TitaniumCloud Script-JS.Trojan.Multiverze

Threat name:

Script-JS.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-30 13:02:07 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f3wxm2ajdzjo6qxe357eyschqykcnn4jn7bw3xnehqql32qqp3pa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260930-xjqpysw16q/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Badlisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/2eed7668091e52ef42e4df7e4c4847861426b7896fc36ddda43c20bdea107ede