MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 538b96f59a98e8c1d667823317d893451dd16d3c7e75203a2bbb2f9eaac4d249. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureLogsStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 7 File information Comments

SHA256 hash:	538b96f59a98e8c1d667823317d893451dd16d3c7e75203a2bbb2f9eaac4d249
SHA3-384 hash:	d08ce3a1695d275ab486077c8cf7a7a34ffad8f633013e405006a5f522ebebcb47132b8800e62c5d3d5a6e5b1b090b9e
SHA1 hash:	10e232ab04689f8dbb4ad21156e3901eac6cb9ea
MD5 hash:	897202f0a2cb2a3619df4fd28cce2924
humanhash:	mockingbird-bluebird-mirror-steak
File name:	SecuriteInfo.com.Heur.MSIL.Benin.5.29468329
Download:	download sample
Signature	PureLogsStealer Create hunting rule
File size:	830'976 bytes
First seen:	2026-07-09 11:43:17 UTC
Last seen:	2026-07-09 12:30:09 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'273 x AgentTesla, 20'619 x Formbook, 12'394 x SnakeKeylogger)
ssdeep	12288:vaqpF+TW5t926psxTbKqRBnDEtRHolyW0kzw/ISn6kiyjjodjKKjP:vjFBpSCoBnDEtRIrPznpAsdjKKj
Threatray	401 similar samples on MalwareBazaar
TLSH	T10C05AE3A32918E21C14A2373D1C7451187EA964776AFFB0B328513F6194B3EEDE0B697
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe PureLogsStealer

Intelligence

File Origin

# of uploads :

# of downloads :

148

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NETReactor

Details

Link:

https://research.acce.ciphertechsolutions.com/results/8fb4f577-52a9-4059-a9ca-a4f0a6873e55/

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Heur.MSIL.Benin.5.29468329.exe

Verdict:

No threats detected

Analysis date:

2026-07-09 11:46:11 UTC

Tags:

netreactor

Link:

https://app.any.run/tasks/540bafe4-449f-40cd-968e-814d08c1f7ec

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/74061/

Detection(s):

SecuriteInfo.com.Heur.MSIL.Benin.5.29468329.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a4f8972a900f0e9eb6b2e14

Tags:

malware

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 net_reactor obfuscated obfuscated packed packed

Link:

https://www.filescan.io/uploads/6a4f8963da0bec49242eaf69/reports/45229f1c-1451-43b8-9dc6-a689f83386ec/overview

Verdict:

Malicious

Labled as:

MSIL.Benin.Generic

Link:

https://www.hybrid-analysis.com/sample/538b96f59a98e8c1d667823317d893451dd16d3c7e75203a2bbb2f9eaac4d249

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-07-09T06:37:00Z UTC

Last seen:

2026-07-11T02:33:00Z UTC

Hits:

~100

Detections:

Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Stealer.HTTP.C&C Trojan-Dropper.Scrop.HTTP.C&C PDM:Trojan.Win32.Generic HEUR:Trojan-Spy.MSIL.Bobik.gen

Link:

https://opentip.kaspersky.com/538b96f59a98e8c1d667823317d893451dd16d3c7e75203a2bbb2f9eaac4d249/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/bf2b36b0-735c-4d5b-9720-f9a5550842f1

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/538b96f59a98e8c1d667823317d893451dd16d3c7e75203a2bbb2f9eaac4d249

Gathering data

Detection:

purelogs

Link:

https://mwdb.cert.pl/sample/538b96f59a98e8c1d667823317d893451dd16d3c7e75203a2bbb2f9eaac4d249/

Verdict:

Malicious

Threat:

Family.PURELOGSSTEALER

Link:

https://tip.neiki.dev/file/538b96f59a98e8c1d667823317d893451dd16d3c7e75203a2bbb2f9eaac4d249

Threat name:

Win32.Trojan.Ravartar

Status:

Malicious

First seen:

2026-07-09 11:44:40 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

28 of 38 (73.68%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kofzn5m2tdumdvthqizrpwetiuo5c3j4pz2saorlxmxz5kwe2jeq._file

Verdict:

malicious

Label(s):

purecrypter

PureLogsStealer

3c3912eb86c12e9f7a0b6d9770dcdd398964154e53b18ba144912a666bc423fb

PureLogsStealer

3ee6743541857a15df54cb62cdb44f492031824d284a8e5ccc5faf43cc21873a

PureLogsStealer

538b96f59a98e8c1d667823317d893451dd16d3c7e75203a2bbb2f9eaac4d249

PureLogsStealer

7daa05906e417d5925666a99773e845506a1527aaa03b9001c3efb8a68315032

PureLogsStealer

9df5a7b74fadadc12c289fff3f5c7f58e3893e5a36df8a287b1f69e588a7e818

PureLogsStealer

c873275988a682f0ff2ce15a3ea1adf456e095f6e84e0e31260173cd9fa7265f

PureLogsStealer

error

PureLogsStealer

f2a5a9ab670552598f032f8c0e22d6ff67bd5061eb33b9efe3251082c044c71c

PureLogsStealer

+ 391 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

adware discovery persistence ransomware spyware

Link:

https://tria.ge/reports/260709-nvs5sahv9q/

Behaviour

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

System Location Discovery: System Language Discovery

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Unpacked files

SH256 hash:

538b96f59a98e8c1d667823317d893451dd16d3c7e75203a2bbb2f9eaac4d249

MD5 hash:

897202f0a2cb2a3619df4fd28cce2924

SHA1 hash:

10e232ab04689f8dbb4ad21156e3901eac6cb9ea

Link:

https://www.unpac.me/results/20f5ff62-5245-45eb-b8fb-9124377ff46f/

SH256 hash:

85251585505222add0d2a365cde9b154ed32bb3dfe964cfb0ac27fd05bd9ef7e

MD5 hash:

63dd26127f1ec3423f52ecf96d73e676

SHA1 hash:

058a7baf1527f5494d36d719048da01ca82b2265

Link:

https://www.unpac.me/results/20f5ff62-5245-45eb-b8fb-9124377ff46f/

SH256 hash:

0520cbd340b0aa31f4325094c9c200a3b2d44d1b0414628dec59782e45ab35a1

MD5 hash:

9ea5ee843fae18fb5f7a7d6342e61525

SHA1 hash:

5eba93c9985f5510902557cc55ace168b7d09365

Link:

https://www.unpac.me/results/20f5ff62-5245-45eb-b8fb-9124377ff46f/

SH256 hash:

4de886fd2c6a02315b9c4460944090fe254fba1fdc036e68b540edce3036f9a6

MD5 hash:

d6a8519875801e2ae0de83cbf9ed6887

SHA1 hash:

79b1e23d715f045731f39fe3908f15cbf36693d1

Link:

https://www.unpac.me/results/20f5ff62-5245-45eb-b8fb-9124377ff46f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/538b96f59a98e8c1d667823317d893451dd16d3c7e75203a2bbb2f9eaac4d249

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.