MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f039f324907bc677baf9d4e64557d8990ad57e58989a43804c063e4e8117302. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureCrypter


Vendor detections: 14


Intelligence 14 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f039f324907bc677baf9d4e64557d8990ad57e58989a43804c063e4e8117302
SHA3-384 hash: e7ce66e57afe414970bfcbe69bb930c7e1c3f2370aec09bb5d20413d64d051c5939b24003618ed287d8c8f82df617c34
SHA1 hash: 00cb978d4955643a8e692516e7220e33f11deea1
MD5 hash: 4ab1342cdf3bb781b982b2d4c7b6d1d6
humanhash: berlin-seven-beer-snake
File name:Setup_v281_x64.exe
Download: download sample
Signature PureCrypter
Create hunting rule
File size:10'652'160 bytes
First seen:2025-08-11 19:42:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a56f115ee5ef2625bd949acaeec66b76 (57 x PureHVNC, 56 x Stealc, 35 x CoinMiner)
ssdeep 196608:/lbY2BY7OqTPCrLcqgG/au5vGdxuwc4/9KbZfwVFhWyBKbkEMyS3:tbXY7jCcG/au7wc4AmFh7BKQryK
Threatray 1 similar samples on MalwareBazaar
TLSH T1B3B633543E84748DCA3B9379AD25D56E2F08BA89061E0C7F395AB60C2D77C0AF7CD891
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
dhash icon 71e8ccf0d4d4d4dc (1 x PureCrypter)
Reporter aachum
Tags:exe purecrypter PureHVNC PureLogs RAT WinSilc wndlogon-hopto-org


Avatar
iamaachum
https://dl7filesbase.top/downloads/apps/AqvtR/AppSetup.rar

C2: wndlogon.hopto.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Setup_v281_x64.exe
Verdict:
Malicious activity
Analysis date:
2025-08-11 19:46:19 UTC
Tags:
netreactor themida auto-sch purecrypter loader purehvnc
Link:
https://app.any.run/tasks/e855f7ad-d3a9-45cd-a233-8e319f998b87

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/20203/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689a47eec633abe3908df954
Tags:
autorun packed shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a file
Launching a process
Deleting a recently created file
Running batch commands
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Connection attempt to an infection source
Query of malicious DNS domain
Sending a TCP request to an infection source
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypt obfuscated packed packed themidawinlicense xpack
Link:
https://www.filescan.io/uploads/689a47ef2fbe0788fb1dc09c/reports/0842c8c5-b4dc-46e0-ab26-ede42817f63e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/2f039f324907bc677baf9d4e64557d8990ad57e58989a43804c063e4e8117302
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5b0e115e-c293-40dd-9b1a-c0620b8bce80
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1754895
Signature
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Found direct / indirect Syscall (likely to bypass EDR)
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suspicious powershell command line found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1754895 Sample: Setup_v281_x64.exe Startdate: 11/08/2025 Architecture: WINDOWS Score: 100 43 wndlogon.hopto.org 2->43 49 Antivirus / Scanner detection for submitted sample 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 Connects to many ports of the same IP (likely port scanning) 2->53 55 3 other signatures 2->55 8 Setup_v281_x64.exe 5 2->8         started        12 winalit.exe 3 2->12         started        signatures3 process4 file5 39 C:\Users\user\AppData\Local\...\winalit.exe, PE32+ 8->39 dropped 41 C:\Users\user\...\Setup_v281_x64.exe.log, CSV 8->41 dropped 65 Detected unpacking (changes PE section rights) 8->65 67 Suspicious powershell command line found 8->67 69 Query firmware table information (likely to detect VMs) 8->69 79 6 other signatures 8->79 14 cmd.exe 1 8->14         started        16 powershell.exe 23 8->16         started        19 schtasks.exe 1 8->19         started        21 2 other processes 8->21 71 Antivirus detection for dropped file 12->71 73 Multi AV Scanner detection for dropped file 12->73 75 Tries to detect sandboxes and other dynamic analysis tools (window names) 12->75 77 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 12->77 signatures6 process7 signatures8 23 winalit.exe 2 14->23         started        27 conhost.exe 14->27         started        47 Loading BitLocker PowerShell Module 16->47 29 WmiPrvSE.exe 16->29         started        31 conhost.exe 16->31         started        33 conhost.exe 19->33         started        35 conhost.exe 21->35         started        37 conhost.exe 21->37         started        process9 dnsIp10 45 wndlogon.hopto.org 185.196.10.200, 49691, 49692, 49693 SIMPLECARRIERCH Switzerland 23->45 57 Query firmware table information (likely to detect VMs) 23->57 59 Hides threads from debuggers 23->59 61 Found direct / indirect Syscall (likely to bypass EDR) 23->61 63 2 other signatures 23->63 signatures11
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2f039f324907bc677baf9d4e64557d8990ad57e58989a43804c063e4e8117302
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) Win 64 Exe x64
Link:
https://app.malva.re/file/4ab1342cdf3bb781b982b2d4c7b6d1d6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2f039f324907bc677baf9d4e64557d8990ad57e58989a43804c063e4e8117302/
Verdict:
Malicious
Threat:
PDM:Trojan.Win32.Agent
Link:
https://tip.neiki.dev/file/2f039f324907bc677baf9d4e64557d8990ad57e58989a43804c063e4e8117302
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-08-11 17:46:01 UTC
File Type:
PE+ (Exe)
Extracted files:
3
AV detection:
16 of 37 (43.24%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f4bz6msja66go65ptvhgivl5rgik2v7frge2ioaeybr6j2aromba._file
Verdict:
malicious
Label(s):
purecrypter
Create hunting rule
Similar samples:
2f039f324907bc677baf9d4e64557d8990ad57e58989a43804c063e4e8117302
PureCrypter
error
PureCrypter
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion execution persistence themida trojan
Link:
https://tria.ge/reports/250811-yfjmxahm9s/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks whether UAC is enabled
Checks BIOS information in registry
Executes dropped EXE
Themida packer
Command and Scripting Interpreter: PowerShell
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9fa0f4e8-64a0-4e07-bf9c-79410f475340
Unpacked files
SH256 hash:
2f039f324907bc677baf9d4e64557d8990ad57e58989a43804c063e4e8117302
MD5 hash:
4ab1342cdf3bb781b982b2d4c7b6d1d6
SHA1 hash:
00cb978d4955643a8e692516e7220e33f11deea1
Link:
https://www.unpac.me/results/ac0e73d6-7d7e-48a4-a1ac-76fbb6a4eb24/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2f039f324907bc677baf9d4e64557d8990ad57e58989a43804c063e4e8117302

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PureCrypter

Executable exe 2f039f324907bc677baf9d4e64557d8990ad57e58989a43804c063e4e8117302

(this sample)

  
Link
https://tria.ge/250811-xswybssxcx/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/20203/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (NX_COMPAT)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high

Comments