🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40737f3d418fd925f0caaf9f06b296f1133bbb2fe9fe704a3295053e679b37aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40737f3d418fd925f0caaf9f06b296f1133bbb2fe9fe704a3295053e679b37aa
SHA3-384 hash: 9f1744adf48bf1e207b03fb3eff41b0873d22f5973a9b38b4ae68c3f5948b3e710b0bdc43ce49c7be54aa2443e270c3d
SHA1 hash: bf31ad6c2df830adffffda89a9fdba345136f4c9
MD5 hash: 060f5a9cb2de61dabb5f0478c663cc34
humanhash: fifteen-tango-monkey-yellow
File name:chứng từ vận chuyển.pdf.exe
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'371'136 bytes
First seen:2026-10-29 07:12:50 UTC
Last seen:2026-10-29 07:34:58 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'301 x AgentTesla, 20'720 x Formbook, 12'402 x SnakeKeylogger)
ssdeep 24576:49zSATMYFDP1aCH01frd092NshT+QeB1MUpvivDJU4v1XpWxINEF4YMN4Ne3r1VR:4lb1aZ1fJds0Qw1MxMxING49N4Ne71VR
TLSH T147550104233AAB42D4766FF55E71E1B017B96CAA3134E54A5ED62DDB3973B00BE02723
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe PureLogsStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
204
Origin country :
FR FR
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e08bfd99-6eed-4847-a7a6-0b598f79322f/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-29 07:24:02 UTC
Tags:
rgbloader loader purelogs purecrypter hanghost netreactor stealer babel
Link:
https://app.any.run/tasks/e091db64-5a54-4501-b2f2-bf7d9b7bd5bc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/95929/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.91155527.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae2f20fb175ade21dce7c73
Tags:
underscore autorun
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
explorer lolbin masquerade obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6ae2f20cf52a8c0a5f1fca21/reports/2dcf059b-050d-45e9-96d2-f5260d51a457/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/40737f3d418fd925f0caaf9f06b296f1133bbb2fe9fe704a3295053e679b37aa
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-28T21:25:00Z UTC
Last seen:
2026-10-31T05:18:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/40737f3d418fd925f0caaf9f06b296f1133bbb2fe9fe704a3295053e679b37aa/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/8f670467-a5b1-4f8c-8565-06f83d120681
Result
Threat name:
PureLogs Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1994475
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected MSIL Injector
Yara detected PureLogs Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1994475 Sample: ch#U1ee9ng t#U1eeb v#U1eadn... Startdate: 29/10/2026 Architecture: WINDOWS Score: 100 43 www.google.com 2->43 45 ideas-irisselection-irisfd-lb.ppe-eus2.ideas-irisselection-irisfd.eastus2-prod.cosmic.office.net 2->45 47 cosmic-eastus2-ns-cf228143ea2a.trafficmanager.net 2->47 81 Suricata IDS alerts for network traffic 2->81 83 Multi AV Scanner detection for submitted file 2->83 85 Yara detected PureLogs Stealer 2->85 87 10 other signatures 2->87 9 ch#U1ee9ng t#U1eeb v#U1eadn chuy#U1ec3n.pdf.exe 3 2->9         started        13 ch#U1ee9ng t#U1eeb v#U1eadn chuy#U1ec3n.pdf.exe 2 2->13         started        signatures3 process4 file5 41 ch#U1ee9ng t#U1eeb...#U1ec3n.pdf.exe.log, ASCII 9->41 dropped 89 Found many strings related to Crypto-Wallets (likely being stolen) 9->89 91 Injects a PE file into a foreign processes 9->91 15 ch#U1ee9ng t#U1eeb v#U1eadn chuy#U1ec3n.pdf.exe 15 5 9->15         started        19 ch#U1ee9ng t#U1eeb v#U1eadn chuy#U1ec3n.pdf.exe 4 13->19         started        21 ch#U1ee9ng t#U1eeb v#U1eadn chuy#U1ec3n.pdf.exe 13->21         started        signatures6 process7 dnsIp8 65 64.89.161.158, 443, 49710, 49712 GHOSTYNETWORKSUS Luxembourg 15->65 67 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->67 69 Tries to steal Mail credentials (via file / registry access) 15->69 71 Found many strings related to Crypto-Wallets (likely being stolen) 15->71 79 4 other signatures 15->79 23 chrome.exe 1 15->23         started        73 Tries to harvest and steal browser information (history, passwords, etc) 19->73 75 Writes to foreign memory regions 19->75 77 Allocates memory in foreign processes 19->77 26 chrome.exe 19->26         started        signatures9 process10 dnsIp11 49 192.168.2.8, 138, 443, 49272 unknown unknown 23->49 28 chrome.exe 2 23->28         started        31 chrome.exe 2 23->31 injected 51 192.168.2.16 unknown unknown 26->51 33 chrome.exe 26->33         started        35 chrome.exe 26->35 injected 37 chrome.exe 26->37 injected 39 chrome.exe 26->39 injected process12 dnsIp13 53 googlehosted.l.googleusercontent.com 142.250.31.132, 443, 49732, 49733 GOOGLE-GoogleLLCUS United States 28->53 55 www.google.com 142.251.154.119, 443, 49719, 49720 GOOGLE-GoogleLLCUS United States 28->55 61 5 other IPs or domains 28->61 57 142.251.150.7, 443, 49771, 49772 GOOGLE-GoogleLLCUS Canada 33->57 59 142.251.155.119, 443, 49758, 49760 GOOGLE-GoogleLLCUS United States 33->59 63 6 other IPs or domains 33->63
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/40737f3d418fd925f0caaf9f06b296f1133bbb2fe9fe704a3295053e679b37aa
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.45 Win 32 Exe x86
Link:
https://app.malva.re/file/060f5a9cb2de61dabb5f0478c663cc34
Detection:
purelogs
Create hunting rule
Link:
https://mwdb.cert.pl/sample/40737f3d418fd925f0caaf9f06b296f1133bbb2fe9fe704a3295053e679b37aa/
Threat name:
ByteCode-MSIL.Backdoor.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2026-10-29 03:27:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ibzx6pkbr7msl4gkv6pqnmuw6ejtxozp5h7hasrssuct4z43g6va._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/261029-h18jrsxxc1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
40737f3d418fd925f0caaf9f06b296f1133bbb2fe9fe704a3295053e679b37aa
MD5 hash:
060f5a9cb2de61dabb5f0478c663cc34
SHA1 hash:
bf31ad6c2df830adffffda89a9fdba345136f4c9
Link:
https://www.unpac.me/results/bc74b0d0-1044-44ec-9198-d951b088ca63/
SH256 hash:
2f950cf33734f0ccdc2b56152f22573dc1ad89b9d12de5f3411ab759763a102f
MD5 hash:
42285e38b24e1da5935b556a3b838ff2
SHA1 hash:
b226b7fc1227ef1cd3231bba9f1de37a6ea68f0f
Link:
https://www.unpac.me/results/bc74b0d0-1044-44ec-9198-d951b088ca63/
SH256 hash:
b9ef8fef5b455817a626806044ae6567cb1f7bafaa7d17a7724a02a25f90d2d2
MD5 hash:
86ce51cb209a5dcd67d0b47572b4e9e2
SHA1 hash:
b6ea8196e73da138d403048b659127ffd5c0c73f
Link:
https://www.unpac.me/results/bc74b0d0-1044-44ec-9198-d951b088ca63/
SH256 hash:
3b3f17e41b26355e053ea9cc840936baf05b211af112ac21f6249422b430fc29
MD5 hash:
4d92f7ae3228cd4fc2ca55f8be46851a
SHA1 hash:
e5b5d558fe9684a6aad4d1165a5a41a818216e52
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/bc74b0d0-1044-44ec-9198-d951b088ca63/
Parent samples :
291b8700ff0080732a7da994fc08fa6f5c420f562363e106f1137bae000ac22f
499f83166c24bf307105138a0030681179911afab628568feab8ba6f3525ebe2
adb39a42de046c9443d3ca4c53f364cb97b5719fcd30cf44206a56534c004cf3
40737f3d418fd925f0caaf9f06b296f1133bbb2fe9fe704a3295053e679b37aa
31592658015dacf038dffbf98b41d0eca512a310f60094ac676179c5aaa0f57e
340090f81bcc5803812f59288a47af37a55582185ab6e1059c4a299704a1dcf6
SH256 hash:
07bfa6794ef11c32543f5e69654b02155000d6cd2099cd666b9ffc3c2ec2136e
MD5 hash:
c9a79a0b45c3d462cb8cb6496c6b95d5
SHA1 hash:
57f1af5d5e8411dcf200ecf334df48738a2904d8
Link:
https://www.unpac.me/results/bc74b0d0-1044-44ec-9198-d951b088ca63/
SH256 hash:
0e41166d3bb64df9c833fc2a0104128905a5cc0c9792a4bba3ad4e8d808ed5fb
MD5 hash:
c5a1778b4e0730223dbd7965ed11cda6
SHA1 hash:
8453e38f48c09823379829e44c3801e81467bb11
Link:
https://www.unpac.me/results/bc74b0d0-1044-44ec-9198-d951b088ca63/
SH256 hash:
6a6684062b7c1af2be8ed4a6420fe83282a74dcc33b5e9d514b5d059bebd676d
MD5 hash:
ebddd63b3ed6ec566dc10249fe0edad3
SHA1 hash:
a47c306ba03e37cc4630139b2f5e943e4e8c32d1
Link:
https://www.unpac.me/results/bc74b0d0-1044-44ec-9198-d951b088ca63/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/40737f3d418fd925f0caaf9f06b296f1133bbb2fe9fe704a3295053e679b37aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/95929/

Comments