MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fe2c3ce085537c3e50dfab194e50e21eefd26bf8859175035191f4448924f0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fe2c3ce085537c3e50dfab194e50e21eefd26bf8859175035191f4448924f0e
SHA3-384 hash: cd26e51b883917ed2ef47aab268716b1d70ce7fe04a58f32bbc76a60a8f0c19254c6e5e8f664ec84cf7dc063a8e1d182
SHA1 hash: fa9f8991715ae644fb3680d0622e9da223a9a7bc
MD5 hash: 785cc3b97e8aac8ceefdb585baea78fd
humanhash: arkansas-yellow-burger-vermont
File name:785cc3b97e8aac8ceefdb585baea78fd.exe
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'828'352 bytes
First seen:2024-08-19 08:40:14 UTC
Last seen:2024-08-19 09:19:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:3C0i3Mu4bxErYevdDSmJV/CHVTHU4uVwCBglkxtX7btD0JGV0AvmtOb251IZNcih:oMuRDXmB0TSFlkv3tDGGVHLme
TLSH T1898533485F48D7B7D2AF1F7DA92284544F79E6A3E602D388FCCCB0E0555238A67242DE
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter abuse_ch
Tags:exe PureLogStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
385
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
785cc3b97e8aac8ceefdb585baea78fd.exe
Verdict:
Malicious activity
Analysis date:
2024-08-19 08:41:10 UTC
Tags:
purecrypter purelogs stealer netreactor exfiltration
Link:
https://app.any.run/tasks/ef209386-84d1-482b-9600-32644b3552ce

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.RATX-gen.21571.13318.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66c3051faa5b40be0aa081e1
Tags:
Network Stealth
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/66c305211136ce49230fe767/reports/3e489fdf-12dc-4ae8-84be-3cb32c2d5915/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/4fe2c3ce085537c3e50dfab194e50e21eefd26bf8859175035191f4448924f0e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/3d24a7a1-c00b-47a4-8d29-d3b1c5c5212a
Result
Threat name:
PureLog Stealer, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1494830
Signature
.NET source code contains potential unpacker
AI detected suspicious sample
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected PureLog Stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4fe2c3ce085537c3e50dfab194e50e21eefd26bf8859175035191f4448924f0e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fe2c3ce085537c3e50dfab194e50e21eefd26bf8859175035191f4448924f0e/
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2024-08-19 08:41:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
13 of 38 (34.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j7rmhtqiku34hzin7kyzjzioehxp2jv7rbmroubvdepuisesj4ha._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection discovery spyware stealer
Link:
https://tria.ge/reports/240819-klez1sxeqm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b795d634-71dc-4196-8c59-275086dbc1f0
Unpacked files
SH256 hash:
e55c54a222af04672cb8a0416b8f5266ddfccdaff7144748b6b41b48ef2b14d2
MD5 hash:
fa2a7d7d933507801ef429f0bf39107f
SHA1 hash:
a45c544b67902fbba8f2ee42cd0fee8117b679a8
Link:
https://www.unpac.me/results/34ebbf7c-8081-4fe5-a258-58fdc6d93323/
SH256 hash:
5787acd9d9c7892e8094fe2eea42add8b56f70622da32d7418b7f7199810eda2
MD5 hash:
c1c8d1544fd1c09dd218b9cd55349fa6
SHA1 hash:
6f2cabefdc025978d2a08fdf54ad2f5f7fcb2996
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/34ebbf7c-8081-4fe5-a258-58fdc6d93323/
Parent samples :
4fe2c3ce085537c3e50dfab194e50e21eefd26bf8859175035191f4448924f0e
78a447652c13652d61bab358c48f634e9c005d38d06e6f93ae260c7aa7236c57
SH256 hash:
c04daaea828d88c57673aa4eb4154270815417f6b3e9598044a81fdc09939925
MD5 hash:
11e856fbe317dc1059e196099989ebe8
SHA1 hash:
de9d2d44d70ab3f4a56600e5480c3b04ffbe381f
Link:
https://www.unpac.me/results/34ebbf7c-8081-4fe5-a258-58fdc6d93323/
SH256 hash:
78f73e1734daa918b253517c75971fbb8df773a3d77d02a752e9a0ad1711a677
MD5 hash:
f9d2985aa1c41cca281321fffb5ed424
SHA1 hash:
3a7a58d2dcae2762882357ae34d372744b1dbb9d
Link:
https://www.unpac.me/results/34ebbf7c-8081-4fe5-a258-58fdc6d93323/
SH256 hash:
a553e53d94f62ea11d4fc7203f5cfe322aeb0ed91352df4d1063f3e6c52df3dd
MD5 hash:
d0e2f00b1a0a50d6e72f46bd010cf674
SHA1 hash:
31cfe5c4d89385861ee55b9810241cb632ec2668
Link:
https://www.unpac.me/results/34ebbf7c-8081-4fe5-a258-58fdc6d93323/
SH256 hash:
831b18622fd6827a5883e121135349f0818ff8fa64ff4a06bcd6478d3c3d5965
MD5 hash:
37c502475af2aef2195439b76dba4116
SHA1 hash:
0d903b46ad62fa78453662d7cc7e53eaa515b237
Detections:
SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/34ebbf7c-8081-4fe5-a258-58fdc6d93323/
Parent samples :
4fe2c3ce085537c3e50dfab194e50e21eefd26bf8859175035191f4448924f0e
78a447652c13652d61bab358c48f634e9c005d38d06e6f93ae260c7aa7236c57
SH256 hash:
539afa16ff8714df522aabbfb72a23e9439245afabb11eb012804f9d1674dd47
MD5 hash:
7b54fbecfaf6abccd04d189d374b1973
SHA1 hash:
ead7067774e6f1536afcc09ecf01fd259e54ba89
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/34ebbf7c-8081-4fe5-a258-58fdc6d93323/
SH256 hash:
4fe2c3ce085537c3e50dfab194e50e21eefd26bf8859175035191f4448924f0e
MD5 hash:
785cc3b97e8aac8ceefdb585baea78fd
SHA1 hash:
fa9f8991715ae644fb3680d0622e9da223a9a7bc
Link:
https://www.unpac.me/results/34ebbf7c-8081-4fe5-a258-58fdc6d93323/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4fe2c3ce0855/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4fe2c3ce085537c3e50dfab194e50e21eefd26bf8859175035191f4448924f0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments