MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf
SHA3-384 hash: 6e0d1ab6c6cc1fa6c886e9a501a32b60f1f3d975f322f42f8fd8281efb370e30e4c1ccc349aebeaf196ea7771489786d
SHA1 hash: 8a36bcb681c19ee4ebc63b61155d1a2a0c0e742d
MD5 hash: d18e6c991fa548d0cf39ea1586738d2f
humanhash: victor-lithium-hydrogen-pizza
File name:SecuriteInfo.com.Trojan.DownLoader46.57007.12424.22631
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'326'080 bytes
First seen:2024-04-19 05:20:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:l5zE03idtBgfNM4NbtbKQ7aZV2+lfJzr27/stxtJvcsWy3as+CBbDMnjwVAgRjI0:6teRexrugPlsWlZ2cwpdlK6LocKZuBu
Threatray 280 similar samples on MalwareBazaar
TLSH T1DF556C517FE28937EAFF4736B4A246042BB8D4C5B741FBCF181922661C473095E29A2F
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon ccb2717933b2d6e8 (1 x PureLogsStealer, 1 x RemcosRAT)
Reporter SecuriteInfoCom
Tags:exe PureLogStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
311
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
lockbit
Create hunting rule
ID:
1
File name:
http://csacsadhe.duckdns.org/byfronbypass.html/css/mss/
Verdict:
Malicious activity
Analysis date:
2024-04-18 17:24:29 UTC
Tags:
opendir loader lockbit ransomware
Link:
https://app.any.run/tasks/a16d2f36-9efc-4ece-8539-872c70bd0f74

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a process with a hidden window
Creating a file
Using the Windows Management Instrumentation requests
Forced system process termination
Creating a process from a recently created file
Deleting a recently created file
Enabling autorun by creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm explorer lolbin packed
Link:
https://www.filescan.io/uploads/6621ff443137a4e0f3bb68d8/reports/a1cf19c6-1db1-4f17-b55c-7b15fed3a856/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/01bb474b-969b-4cca-abc3-598fd601829a
Result
Threat name:
PureLog Stealer, Xmrig, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1428544
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Connects to many ports of the same IP (likely port scanning)
Detected Stratum mining protocol
Downloads files with wrong headers with respect to MIME Content-Type
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Silenttrinity Stager Msbuild Activity
Sigma detected: Suspicious Child Process of AspNetCompiler
Sigma detected: Xmrig
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Yara detected PureLog Stealer
Yara detected Xmrig cryptocurrency miner
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1428544 Sample: SecuriteInfo.com.Trojan.Dow... Startdate: 19/04/2024 Architecture: WINDOWS Score: 100 67 miliutyhgdue.duckdns.org 2->67 69 juytlioojbni.duckdns.org 2->69 71 2 other IPs or domains 2->71 91 Sigma detected: Xmrig 2->91 93 Multi AV Scanner detection for domain / URL 2->93 95 Malicious sample detected (through community Yara rule) 2->95 99 21 other signatures 2->99 11 AlgorithmType.exe 2->11         started        14 Keywords.exe 14 3 2->14         started        16 fdyryi.exe 2->16         started        18 5 other processes 2->18 signatures3 97 Uses dynamic DNS services 69->97 process4 dnsIp5 113 Antivirus detection for dropped file 11->113 115 Multi AV Scanner detection for dropped file 11->115 117 Machine Learning detection for dropped file 11->117 21 AlgorithmType.exe 11->21         started        119 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->119 121 Injects a PE file into a foreign processes 14->121 24 Keywords.exe 14->24         started        123 Modifies the context of a thread in another process (thread injection) 16->123 26 fdyryi.exe 16->26         started        73 juytlioojbni.duckdns.org 91.92.246.15, 49701, 49702, 49703 THEZONEBG Bulgaria 18->73 125 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 18->125 127 Loading BitLocker PowerShell Module 18->127 29 SecuriteInfo.com.Trojan.DownLoader46.57007.12424.22631.exe 6 18->29         started        31 conhost.exe 18->31         started        33 conhost.exe 18->33         started        35 2 other processes 18->35 signatures6 process7 file8 101 Writes to foreign memory regions 21->101 103 Modifies the context of a thread in another process (thread injection) 21->103 105 Injects a PE file into a foreign processes 21->105 37 aspnet_compiler.exe 21->37         started        40 MSBuild.exe 24->40         started        59 C:\Users\user\AppData\...\AlgorithmType.exe, PE32+ 26->59 dropped 61 C:\Users\user\AppData\Local\...\Keywords.exe, PE32 29->61 dropped signatures9 process10 signatures11 107 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 37->107 109 Modifies the context of a thread in another process (thread injection) 37->109 111 Injects a PE file into a foreign processes 37->111 42 aspnet_compiler.exe 37->42         started        47 MSBuild.exe 40->47         started        process12 dnsIp13 77 bnfjdbhgo.duckdns.org 91.92.254.152 THEZONEBG Bulgaria 42->77 63 C:\Users\user\AppData\Local\...\pjmskbbdr.exe, PE32 42->63 dropped 129 Writes to foreign memory regions 42->129 131 Modifies the context of a thread in another process (thread injection) 42->131 133 Injects a PE file into a foreign processes 42->133 49 pjmskbbdr.exe 42->49         started        52 AddInProcess.exe 42->52         started        55 AddInProcess.exe 42->55         started        79 miliutyhgdue.duckdns.org 91.92.253.47, 49709, 49711, 49712 THEZONEBG Bulgaria 47->79 65 C:\Users\user\AppData\Local\Temp\fdyryi.exe, PE32+ 47->65 dropped file14 signatures15 process16 dnsIp17 81 Antivirus detection for dropped file 49->81 83 Multi AV Scanner detection for dropped file 49->83 85 Writes to foreign memory regions 49->85 87 Injects a PE file into a foreign processes 49->87 57 RegAsm.exe 49->57         started        75 91.92.246.62 THEZONEBG Bulgaria 52->75 89 Query firmware table information (likely to detect VMs) 52->89 signatures18 process19
Score:
91%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf/
Threat name:
ByteCode-MSIL.Trojan.ZgRAT
Create hunting rule
Status:
Malicious
First seen:
2024-04-14 01:35:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ifkqds5fe7xv4ai72daybzcviw3waloclv3khudveiqpeb4gdoxq._file
Verdict:
malicious
Similar samples:
1b1b9cad3a2bd2c8bdabd5677e3c5043f66d8cdb46c2825e27b051d48e0afa8d
PureLogsStealer
415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf
PureLogsStealer
4acddc15352051552d4684fff6d07d18305cf7276d208adf7e2f59c5a70c909a
PureLogsStealer
572e5e6295f7bc9877c82de35f32ed4039cc68c7d8f508be1c9302b795b09deb
PureLogsStealer
68d282c16c83a849e29fb395b3e1864c3df158edf47a92ffb078b81dcafd7888
PureLogsStealer
9df4aaa956d54f55f1bb038f3e8f086169983e094ef8432cd71df928a888a2d0
PureLogsStealer
ddd3762a1f95e1f86b86a92e54f2d52b2e9b96499a6fdc07fab98813eeaca8a2
PureLogsStealer
+ 270 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:zgrat rat
Link:
https://tria.ge/reports/240419-f1zwhshh35/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Suspicious use of SetThreadContext
Executes dropped EXE
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf
MD5 hash:
d18e6c991fa548d0cf39ea1586738d2f
SHA1 hash:
8a36bcb681c19ee4ebc63b61155d1a2a0c0e742d
Link:
https://www.unpac.me/results/d50be792-a61b-4ade-a33f-424f2c8686e7/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/415501cba527/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:PureCrypter
Create hunting rule
Author:@bartblaze
Description:Identifies PureCrypter, .NET loader and obfuscator.
Reference:https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments