MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3298664374264a54bf1478c665c3d1bd92042a7bd41c60c8374ac88a9e5c9123. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3298664374264a54bf1478c665c3d1bd92042a7bd41c60c8374ac88a9e5c9123
SHA3-384 hash: bc942b7d3d402a033b64ebfa2b2740f2d8b616c68db63903baa09d96c24eb1fbd4fdc0b4c5c245417d3d7b8eaefe475a
SHA1 hash: 1d535bbd0cd27a647cff1c49347da6f212e0e0f6
MD5 hash: 370c09bf58037dbbc84bba4e1ec38d7e
humanhash: seventeen-three-oregon-freddie
File name:Purchase _ Inquiry Rechnung_0103737.scr
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:10'240 bytes
First seen:2024-02-05 10:25:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 96:/2f9VtieiJRbsU1Hnl+wC2ZP4vO1zV7p0U08Tde3bCz/kXmGBzNt:WIe8Rx+QP4kJ7k85YWz/k2U
Threatray 104 similar samples on MalwareBazaar
TLSH T1F322723977FC4626F9BA0B318CB1025576E9BFA5EDA0C74FD099010F4D22AD01DA1B5B
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 314d092666196965 (1 x zgRAT, 1 x PureLogsStealer)
Reporter lowmal3
Tags:exe PureLogStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
289
Origin country :
DE DE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/474666/
Detection(s):
SecuriteInfo.com.Trojan.Downloader.10124.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/65c0b7bf0b80a4072892883f/reports/a5b4404a-8ec5-47c7-a62b-e300dcd47e7d/overview
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/3298664374264a54bf1478c665c3d1bd92042a7bd41c60c8374ac88a9e5c9123
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
MassLogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/de2fe003-2ca9-4673-9f97-3551ef365223
Result
Threat name:
PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1386692
Signature
.NET source code contains potential unpacker
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1386692 Sample: Purchase___Inquiry_Rechnung... Startdate: 05/02/2024 Architecture: WINDOWS Score: 100 31 cdn.discordapp.com 2->31 33 90.156.5.0.in-addr.arpa 2->33 47 Snort IDS alert for network traffic 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Yara detected PureLog Stealer 2->51 53 5 other signatures 2->53 7 Purchase___Inquiry_Rechnung_0103737.scr.exe 15 5 2->7         started        12 Ukxnyzxexx.exe 4 2->12         started        14 Ukxnyzxexx.exe 14 5 2->14         started        signatures3 process4 dnsIp5 35 cdn.discordapp.com 162.159.135.233, 443, 49729, 49737 CLOUDFLARENETUS United States 7->35 27 C:\Users\user\AppData\...\Ukxnyzxexx.exe, PE32+ 7->27 dropped 55 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->55 57 Modifies the context of a thread in another process (thread injection) 7->57 59 Injects a PE file into a foreign processes 7->59 16 Purchase___Inquiry_Rechnung_0103737.scr.exe 23 7->16         started        21 Ukxnyzxexx.exe 12->21         started        61 Multi AV Scanner detection for dropped file 14->61 23 Ukxnyzxexx.exe 14->23         started        file6 signatures7 process8 dnsIp9 29 65.108.26.131, 2024, 49735, 49736 ALABANZA-BALTUS United States 16->29 25 C:\Users\user\AppData\...\sqlite.interop.dll, PE32+ 16->25 dropped 37 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->37 39 Tries to steal Mail credentials (via file / registry access) 16->39 41 Found many strings related to Crypto-Wallets (likely being stolen) 16->41 43 Tries to harvest and steal browser information (history, passwords, etc) 21->43 45 Tries to harvest and steal Bitcoin Wallet information 21->45 file10 signatures11
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3298664374264a54bf1478c665c3d1bd92042a7bd41c60c8374ac88a9e5c9123
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3298664374264a54bf1478c665c3d1bd92042a7bd41c60c8374ac88a9e5c9123/
Threat name:
ByteCode-MSIL.Trojan.Seraph
Create hunting rule
Status:
Malicious
First seen:
2024-02-01 04:35:30 UTC
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gkmgmq3uezffjpyupddglq6rxwjaikt32qogbsbxjleivhs4serq._file
Verdict:
malicious
Similar samples:
0f536ab69a6b86c2725fb65d54f9386cdc464291e4f8796ce50ba9366dcd432f
PureLogsStealer
3298664374264a54bf1478c665c3d1bd92042a7bd41c60c8374ac88a9e5c9123
PureLogsStealer
83c927ee7be29bc9002512ec371d11211fa96a5ec577336bca4fe789d9419104
PureLogsStealer
859beadc69ed87ed6a706cb57d8a46f502cca1b826afe66672475c41f11f8055
PureLogsStealer
b60b359020b150360d52a3c0f0d9cc8b6a6aceb32075cfa06b9502e25a8403ff
PureLogsStealer
bdd18149da8dd36475433df59529ff1159969bb23aa34274e9a114e2979dfdc8
PureLogsStealer
d7a2ae6d4c8ab5d13d4298334e9d95f82770ace62b3bb62cd683d3017f768da6
PureLogsStealer
dce0b953b9201d59cd92a30bce45190f9c763690a09a7a279024d8cf4b8ce171
PureLogsStealer
fefc63a2948e070ff4447b44700b1a83eef1ab7607338e969e16859b69ab6b20
PureLogsStealer
+ 94 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:zgrat collection persistence rat spyware stealer
Link:
https://tria.ge/reports/240205-mghw8affgj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Loads dropped DLL
Reads user/profile data of web browsers
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
3298664374264a54bf1478c665c3d1bd92042a7bd41c60c8374ac88a9e5c9123
MD5 hash:
370c09bf58037dbbc84bba4e1ec38d7e
SHA1 hash:
1d535bbd0cd27a647cff1c49347da6f212e0e0f6
Detections:
SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Link:
https://www.unpac.me/results/eede1936-0623-4c35-b366-bc80cb744bb5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.77
Link:
https://yomi.yoroi.company/submissions/3298664374264a54bf1478c665c3d1bd92042a7bd41c60c8374ac88a9e5c9123

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:MSIL_TinyDownloader_Generic
Create hunting rule
Author:albertzsigovits
Description:Detects small-sized dotNET downloaders
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Discord_Attachments_URL
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads
Rule name:SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

PureLogsStealer

Executable exe 3298664374264a54bf1478c665c3d1bd92042a7bd41c60c8374ac88a9e5c9123

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/474666/

Comments