MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 475d33e7694eb0bd66231d242a27abd4ceec807bbcb155a636ee4e1e80d0be38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
PureLogsStealer
Vendor detections: 16
| SHA256 hash: | 475d33e7694eb0bd66231d242a27abd4ceec807bbcb155a636ee4e1e80d0be38 |
|---|---|
| SHA3-384 hash: | 842719ef546bd0f3424f599885b04268d8df288d59489405e687381a31f10ba82fe351b3676ca15a4ebe92797ce947ee |
| SHA1 hash: | 01e1b46264c9cc11ec92c62995f38cab4214decf |
| MD5 hash: | 4c18e5e8539f55337176f89800922417 |
| humanhash: | two-autumn-coffee-hot |
| File name: | SecuriteInfo.com.BackDoor.AgentTeslaNET.56.22591.29916 |
| Download: | download sample |
| Signature | PureLogsStealer |
| File size: | 929'792 bytes |
| First seen: | 2025-04-08 12:15:30 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:uYHKYqBCCwfCSMya0vfVn2nM3Z61Ed/ZFljY2DzskmGJkmecun2LgfjQjlvZYxC5:lf6Vya0HV2w0q/RM+z3mWkxco2LgBEe |
| TLSH | T1F315F1A4332CD807C57643F95860D3B403B66EAD7621E3C69EDABCCB38E5F851A40697 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| dhash icon | 0068617171617000 (6 x SnakeKeylogger, 2 x MassLogger, 2 x AgentTesla) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe PureLogStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
425
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.BackDoor.AgentTeslaNET.56.22591.29916
Verdict:
Malicious activity
Analysis date:
2025-04-08 18:30:49 UTC
Tags:
purecrypter purelogs netreactor stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
90.2%
Tags:
kryptik virus msil
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected vbnet
Verdict:
Malicious
Labled as:
Trojan.Generic
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
PureLog Stealer
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Costura Assembly Loader
Yara detected Generic Stealer
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2025-04-07 07:00:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
20 of 24 (83.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
collection discovery spyware stealer
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
475d33e7694eb0bd66231d242a27abd4ceec807bbcb155a636ee4e1e80d0be38
MD5 hash:
4c18e5e8539f55337176f89800922417
SHA1 hash:
01e1b46264c9cc11ec92c62995f38cab4214decf
SH256 hash:
19f6515795f958f49f548afadb03880744f3df1f7acdbdd66a1f62992f330d26
MD5 hash:
ef2a4ed7b447b1c0cab11aea8a9441ce
SHA1 hash:
081e773a263502f53497437d97085410a6c07bd7
SH256 hash:
47ccc810542a8ed74543a2b1a9f0373dbabebc04c413090342168744761b0dee
MD5 hash:
592908ad12b102031498a83579ccc24e
SHA1 hash:
194c9ac47f99ec92291613b2d06af439d288a534
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
bc9bd04705b4b36ae9ff736364728125b9f6add2c7a7cbd623ab3dbb35e1c3e8
MD5 hash:
ebc210470097562169cd025f12a6f2c9
SHA1 hash:
56d7295f17a9e022db64d422f44af7c2252a532e
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
SH256 hash:
fe361210dba7277577ba6f86a77c6bd2a9a2b217317d5b5dc6d9c64c0a722bc9
MD5 hash:
a170312f84eb41365d9c03b3f5e24e50
SHA1 hash:
88536b62917af9ad8b1eaa4256d4f2413d88dc5e
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
ad874af452973eb89933965ea9eb587de7150999255142da2bfb254e7e1a9260
MD5 hash:
1759d8af88473a5715597c3b5128f536
SHA1 hash:
b99aa5fb7d21d9c4888a9073dee7b28ca161895d
Malware family:
zgRAT
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.