MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55357c1468ac99c2b2a8ecf55151c3e80fe023712ab40b1a6bcb990ec1a85e18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureLogsStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 7 File information Comments

SHA256 hash:	55357c1468ac99c2b2a8ecf55151c3e80fe023712ab40b1a6bcb990ec1a85e18
SHA3-384 hash:	ee99467bb7d936a5f12dc2b902e64a979fae56dbb9a01efef9d5b534df475eb49f385359e2711bfd4c35b4b2ace99d16
SHA1 hash:	4cc9ef239e9465fe8bd07e9874c42e5189ed71dd
MD5 hash:	23c6863584934819cafcc7c2dd72c964
humanhash:	nebraska-cola-delta-blue
File name:	SecuriteInfo.com.Trojan.PWS.Stealer.45485.8471.29912
Download:	download sample
Signature	PureLogsStealer Create hunting rule
File size:	577'024 bytes
First seen:	2026-06-08 23:47:15 UTC
Last seen:	2026-06-09 00:20:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'287 x AgentTesla, 20'689 x Formbook, 12'401 x SnakeKeylogger)
ssdeep	6144:YUL6+giWe6U20DyhzITCfrpLiTy2VFkzgGza6u1bUEE5i1SK+XPIedg1Id9FUqef:YQG5EDIlotGmv1bTE5jHg2rlTDfWR
Threatray	121 similar samples on MalwareBazaar
TLSH	T175C401433BD48F12C9445275C5E7896403E5E9C72AF3D30A3A49239B0E827E5DE96FCA
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe PureLogsStealer

Intelligence

File Origin

# of uploads :

# of downloads :

145

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NETReactor

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f14458d4-2232-4492-8a31-a9f704e05bad/

Malware family:

n/a

ID:

File name:

Payment Confirmation and Invoice Summary GMISI Orders (Total USD 13977.09 ).msg

Verdict:

Malicious activity

Analysis date:

2026-05-18 12:40:07 UTC

Tags:

susp-attachments attachments attc-unc arch-scr susp-powershell loader stealer

Link:

https://app.any.run/tasks/7d24f3a6-03cb-41ae-8d96-fe067c9a88f3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/70222/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Stealer.45485.8471.29912.UNOFFICIAL

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2754923e9eff6a6b68ed5f

Tags:

virus msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 net_reactor obfuscated obfuscated packed packed stealer

Link:

https://www.filescan.io/uploads/6a27548dbf16337e43bd3aa9/reports/3a70cb74-64ef-456a-b3c0-8b10253482c1/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/55357c1468ac99c2b2a8ecf55151c3e80fe023712ab40b1a6bcb990ec1a85e18

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-05-18T15:33:00Z UTC

Last seen:

2026-06-09T20:25:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/55357c1468ac99c2b2a8ecf55151c3e80fe023712ab40b1a6bcb990ec1a85e18/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/1703d346-787e-4084-8e77-8430339e9fab

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/55357c1468ac99c2b2a8ecf55151c3e80fe023712ab40b1a6bcb990ec1a85e18

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/55357c1468ac99c2b2a8ecf55151c3e80fe023712ab40b1a6bcb990ec1a85e18/

Threat name:

ByteCode-MSIL.Trojan.Barys

Status:

Malicious

First seen:

2026-05-18 18:08:01 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

28 of 36 (77.78%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ku2xyfdivsm4fmvi5t2vcuod5ah6ai3rfk2awgtlzomq5qnilyma._file

Verdict:

malicious

Label(s):

purecrypter

PureLogsStealer

55357c1468ac99c2b2a8ecf55151c3e80fe023712ab40b1a6bcb990ec1a85e18

PureLogsStealer

7cc7c63542bfc39f82020d99cd5d84032ebcc85c3d941b1b9b2f74f52d529f20

PureLogsStealer

c52755dff77ce635cbfbc96ce0d74519584cef8b9721b3f48210d3a71be4ac2b

PureLogsStealer

d4257b932ce68de15a9a9fc52ee7a9b4e78e7058e5effdd597142c557ed2f85e

PureLogsStealer

df915ff4a85619f377c321e2a2cfd3d53051380b971441f117ddf16c8786a022

PureLogsStealer

ee078c1c983e1ffedc6221c81c8cb69896d073b157d08101cf51c9ed36dd131d

PureLogsStealer

error

PureLogsStealer

f9aa29d9b2ba2551de3331bfd681b5a71af3c5d7f32badc68e5f8b96a5631841

PureLogsStealer

+ 111 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

collection discovery spyware stealer

Link:

https://tria.ge/reports/260608-3s3c1aht3k/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Accesses Microsoft Outlook profiles

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

55357c1468ac99c2b2a8ecf55151c3e80fe023712ab40b1a6bcb990ec1a85e18

MD5 hash:

23c6863584934819cafcc7c2dd72c964

SHA1 hash:

4cc9ef239e9465fe8bd07e9874c42e5189ed71dd

Link:

https://www.unpac.me/results/ccff7ccd-f870-48ae-a176-20085265fef4/

SH256 hash:

8651cefa0c66bf47d67cd7b9b1006c009e10edad708af0f25082b0546ad65c9a

MD5 hash:

17f614fbfda13bf97c890c05acd4b6b4

SHA1 hash:

201653cb7540038ae8f17b17fa7287e7568a0c5b

Link:

https://www.unpac.me/results/ccff7ccd-f870-48ae-a176-20085265fef4/

SH256 hash:

d4c3f1a1a8f0022c41c07c3add363963f50b54cd1c0f0cc4d7aa4b4d2760c064

MD5 hash:

15b745eced0ed3e520e54beef169fa57

SHA1 hash:

508a5cd7392f85d9663ee91a9c18973e0261df94

Link:

https://www.unpac.me/results/ccff7ccd-f870-48ae-a176-20085265fef4/

SH256 hash:

b2a66e9864f81c2800a5afef4bfd1faf7c910e5a43ea2eb9dbb15c8ab6ffc633

MD5 hash:

f0a13fb422cdb1f3ce667df897b5045b

SHA1 hash:

9b6566603e3a292482788924a83a1d94a9cd4627

Link:

https://www.unpac.me/results/ccff7ccd-f870-48ae-a176-20085265fef4/

Malware family:

BabelVM

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/55357c1468ac/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/55357c1468ac99c2b2a8ecf55151c3e80fe023712ab40b1a6bcb990ec1a85e18

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.