MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54a8d0df199ee2b8bf8fea306f6a6df3cd4b2e9de579ba2dbf8e20ec9c3518b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54a8d0df199ee2b8bf8fea306f6a6df3cd4b2e9de579ba2dbf8e20ec9c3518b4
SHA3-384 hash: 9faa92de8d37fc0a6cb26480b600a49844bcbaea53c0ef313bf5c73d7031797289041c717497ea81a7b227dc505f0448
SHA1 hash: 963229ae2ca4da7c10c75683e440e65fff414407
MD5 hash: bf1eb8d8ac889baaa77dfc8bd379fff9
humanhash: cup-kilo-emma-wisconsin
File name:e-Statement of your deposit.exe
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'588'736 bytes
First seen:2026-08-04 07:00:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'131 x AgentTesla, 20'159 x Formbook, 12'362 x SnakeKeylogger)
ssdeep 49152:OV3qKtaocQYdo1IvtyMauQ8KCwsarOwMyBe+TUB:43qKtaoBPuJQ1tyx++
TLSH T1FD7523B093A5CC52EEEC873350B6D3B95174AE9DA8029747CBDEBDF77A5421C3890680
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon a282b2b2e8e882b2 (2 x PureLogsStealer, 2 x OverlordRAT)
Reporter abuse_ch
Tags:exe PureLogsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/70c36d07-eac9-43a6-b1c7-3556ee07f2db/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-08-04 07:13:03 UTC
Tags:
stealer exfiltration smtp auto-startup netreactor
Link:
https://app.any.run/tasks/b8ecbe72-5c08-4f54-b010-280ef0499317

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/78738/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.13847267.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/6a718e4ebae3580c18528f21/reports/cf53c9ca-2464-48ea-80ad-fa2cc2ef596d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/54a8d0df199ee2b8bf8fea306f6a6df3cd4b2e9de579ba2dbf8e20ec9c3518b4
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-04T02:05:00Z UTC
Last seen:
2026-08-06T05:18:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/54a8d0df199ee2b8bf8fea306f6a6df3cd4b2e9de579ba2dbf8e20ec9c3518b4/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d73a5618-634b-4986-8241-14071fc107c0
Result
Threat name:
PureLogs Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1951696
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected MSIL Injector
Yara detected PureLogs Stealer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1951696 Sample: e-Statement of your deposit.exe Startdate: 04/08/2026 Architecture: WINDOWS Score: 100 60 Multi AV Scanner detection for submitted file 2->60 62 Yara detected PureLogs Stealer 2->62 64 Yara detected MSIL Injector 2->64 66 6 other signatures 2->66 8 e-Statement of your deposit.exe 3 2->8         started        12 e-Statement of your deposit.exe 2 2->12         started        process3 file4 38 C:\...\e-Statement of your deposit.exe.log, ASCII 8->38 dropped 68 Found many strings related to Crypto-Wallets (likely being stolen) 8->68 70 Injects a PE file into a foreign processes 8->70 14 e-Statement of your deposit.exe 15 5 8->14         started        18 e-Statement of your deposit.exe 4 12->18         started        signatures5 process6 dnsIp7 58 46.151.182.159, 49706, 49712, 49716 GHOSTYNETWORKSUS France 14->58 72 Tries to steal Mail credentials (via file / registry access) 14->72 74 Found many strings related to Crypto-Wallets (likely being stolen) 14->74 76 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->76 84 2 other signatures 14->84 20 chrome.exe 3 14->20         started        23 chrome.exe 2 14->23 injected 78 Tries to harvest and steal browser information (history, passwords, etc) 18->78 80 Writes to foreign memory regions 18->80 82 Tries to harvest and steal Bitcoin Wallet information 18->82 25 chrome.exe 18->25         started        27 chrome.exe 18->27 injected 29 chrome.exe 18->29 injected 31 2 other processes 18->31 signatures8 process9 dnsIp10 52 192.168.2.10 unknown unknown 20->52 54 192.168.2.24 unknown unknown 20->54 56 2 other IPs or domains 20->56 33 chrome.exe 2 20->33         started        36 chrome.exe 25->36         started        process11 dnsIp12 40 www.google.com 142.251.156.119, 443, 49720, 49721 GOOGLE-GoogleLLCUS United States 33->40 42 googlehosted.l.googleusercontent.com 142.251.219.1, 443, 49732 GOOGLE-GoogleLLCUS United States 33->42 44 clients2.googleusercontent.com 33->44 46 142.251.154.119, 443, 49751, 49752 GOOGLE-GoogleLLCUS United States 36->46 48 mobile-gtalk.l.google.com 142.251.2.188, 49775, 5228 GOOGLE-GoogleLLCUS United States 36->48 50 5 other IPs or domains 36->50
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/54a8d0df199ee2b8bf8fea306f6a6df3cd4b2e9de579ba2dbf8e20ec9c3518b4
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.30 Win 32 Exe x86
Link:
https://app.malva.re/file/bf1eb8d8ac889baaa77dfc8bd379fff9
Detection:
purelogs
Create hunting rule
Link:
https://mwdb.cert.pl/sample/54a8d0df199ee2b8bf8fea306f6a6df3cd4b2e9de579ba2dbf8e20ec9c3518b4/
Threat name:
Win32.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2026-08-04 07:01:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ksunbxyzt3rlrp4p5iyg62tn6pguwlu54v43uln7ryqozhbvdc2a._file
Verdict:
malicious
Label(s):
PureCrypter
Create hunting rule
Link:
https://reports.threatray.com/d6e648f8-ca63-46c4-8852-80f365ab5450
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection discovery persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/260804-hthprshq6t/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Creates a file in the Startup directory
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
54a8d0df199ee2b8bf8fea306f6a6df3cd4b2e9de579ba2dbf8e20ec9c3518b4
MD5 hash:
bf1eb8d8ac889baaa77dfc8bd379fff9
SHA1 hash:
963229ae2ca4da7c10c75683e440e65fff414407
Link:
https://www.unpac.me/results/6b7832f7-fbc5-44f0-994d-91193564ca24/
SH256 hash:
7672ecef65b42c747fb9fac99f2281637fb92bd4f7adb43b02198c4c2ad56e55
MD5 hash:
660c82e5362a9eac830ade229cf4790a
SHA1 hash:
2ed1d6d8abaf853f0de33451d592ee50ee071a73
Link:
https://www.unpac.me/results/6b7832f7-fbc5-44f0-994d-91193564ca24/
SH256 hash:
6d76e87569f4c5dfa355c3a7a697d9236e90c71db1b42db7e1490d5ded41e17b
MD5 hash:
7f055f4fa6b5e1caa66d4dd91a1949d1
SHA1 hash:
bd30da27bd546c478840d154babcebc76d4d47d8
Link:
https://www.unpac.me/results/6b7832f7-fbc5-44f0-994d-91193564ca24/
SH256 hash:
7a03ae73242cfbce3f9bb514f5702c087c5377a606fe05bfd513cac322736b04
MD5 hash:
1e2488a2c6078936353e68bf0dac74ed
SHA1 hash:
ee627af2f04af07a91b4612cd9e83a5dbb35483e
Link:
https://www.unpac.me/results/6b7832f7-fbc5-44f0-994d-91193564ca24/
SH256 hash:
622daa1a0a5cda9c535a71e52fb49732dc6d63de950c7a8f3152d2335844eb41
MD5 hash:
89cc16d7cbde56f5f46d7114d958b23a
SHA1 hash:
0ff183d23ba5eab37204432f06376cd74e9632ca
Link:
https://www.unpac.me/results/6b7832f7-fbc5-44f0-994d-91193564ca24/
SH256 hash:
e85019d4896052226719f84da2c692fd531f2d8333d30da8609fce649c22cede
MD5 hash:
e530c6e3e9a1bc8edbba508b73130012
SHA1 hash:
58c38ab102887e49ef57ce60dccfea6b1031590c
Link:
https://www.unpac.me/results/6b7832f7-fbc5-44f0-994d-91193564ca24/
SH256 hash:
87f8c5179cc236f432cb0ed0077557ef4c4499871ab857a8a042983f1b932010
MD5 hash:
b0c6c49b70f5a43a58a9d6ef30256ad9
SHA1 hash:
b8959efa89c74f0bebb94ca4576189894c5463a2
Link:
https://www.unpac.me/results/6b7832f7-fbc5-44f0-994d-91193564ca24/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/54a8d0df199e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/54a8d0df199ee2b8bf8fea306f6a6df3cd4b2e9de579ba2dbf8e20ec9c3518b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/78738/

Comments