MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55717f1860706ae2447e0912146162ba199d4e9d56cc4e059478179fc27c2e5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 17


Intelligence 17 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55717f1860706ae2447e0912146162ba199d4e9d56cc4e059478179fc27c2e5f
SHA3-384 hash: 2637e259471cd55d35f5cdeab3478713c8d0158a9970cb0942df3182a571ee92ed735dc7aad0827bd6b23206e452fcb8
SHA1 hash: 3d0b11817ab58f6f85f4183b789bf76b9e751fc0
MD5 hash: 60637fc5c912dfd517b8cf0ffc76e720
humanhash: tennessee-mirror-massachusetts-papa
File name:USD 671,210.exe
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'067'008 bytes
First seen:2026-01-15 10:05:20 UTC
Last seen:2026-01-16 01:30:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'122 x AgentTesla, 20'133 x Formbook, 12'360 x SnakeKeylogger)
ssdeep 24576:8AIGK2or+6CJAOCCZNwrPNBEkoxi0sMLrWZzHf5cosGsF:8AtporbCJ/ZNGBETiULrW9Hfe9
Threatray 35 similar samples on MalwareBazaar
TLSH T11A35126EB6A1AA66D7CC1FBBC4032200C2F38462E631FA2B4DD56DD55F26385C10ED67
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter abuse_ch
Tags:exe PureLogsStealer


Avatar
abuse_ch
PureLogsStealer C2:
198.46.178.137:8107

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
198.46.178.137:8107 https://threatfox.abuse.ch/ioc/1732399/

Intelligence

File Origin
# of uploads :
2
# of downloads :
200
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
DeepSea
Details
DeepSea
DeepSea decrypted strings
Link:
https://research.acce.ciphertechsolutions.com/results/1ca5445a-044e-4457-a6ec-6993bb3777d3/
Malware family:
n/a
ID:
1
File name:
USD 671,210.exe
Verdict:
Malicious activity
Analysis date:
2026-01-15 10:05:25 UTC
Tags:
stealer purecrypter purehvnc netreactor
Link:
https://app.any.run/tasks/7457f888-0047-4834-8843-58175dfd7ad9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/48979/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6968bbe9ef906a21abcd71bd
Tags:
stration shell micro
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
explorer lolbin obfuscated obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6968bbe83827c9e1249f800d/reports/faa4ccae-f6b6-4d8a-adc7-eac771920a0b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/55717f1860706ae2447e0912146162ba199d4e9d56cc4e059478179fc27c2e5f
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-15T07:18:00Z UTC
Last seen:
2026-01-17T04:21:00Z UTC
Hits:
~100
Detections:
Trojan.MSIL.Crypt.sb UDS:DangerousObject.Multi.Generic Trojan-PSW.PureLogs.TCP.C&C PDM:Trojan.Win32.Generic HEUR:Trojan-PSW.MSIL.PureLogs.gen Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb VHO:Backdoor.Win32.Agent.gen VHO:Trojan-PSW.MSIL.PureLogs.gen
Link:
https://opentip.kaspersky.com/55717f1860706ae2447e0912146162ba199d4e9d56cc4e059478179fc27c2e5f/results?tab=lookup
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9652ac1d-f010-4067-9b3d-19e210c8aeeb
Result
Threat name:
PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1851247
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1851247 Sample: USD 671,210.exe Startdate: 15/01/2026 Architecture: WINDOWS Score: 100 50 Suricata IDS alerts for network traffic 2->50 52 Multi AV Scanner detection for dropped file 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 9 other signatures 2->56 8 USD 671,210.exe 5 2->8         started        process3 file4 36 C:\Users\user\Desktop\PWB.dll, PE32 8->36 dropped 38 C:\Users\user\AppData\...\USD 671,210.exe.log, ASCII 8->38 dropped 58 Adds a directory exclusion to Windows Defender 8->58 60 Injects a PE file into a foreign processes 8->60 12 USD 671,210.exe 3 8->12         started        16 powershell.exe 23 8->16         started        18 USD 671,210.exe 8->18         started        20 2 other processes 8->20 signatures5 process6 dnsIp7 48 198.46.178.137, 49717, 49747, 49748 AS-COLOCROSSINGUS United States 12->48 62 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->62 64 Tries to steal Mail credentials (via file / registry access) 12->64 66 Tries to harvest and steal browser information (history, passwords, etc) 12->66 70 5 other signatures 12->70 22 chrome.exe 1 12->22         started        25 chrome.exe 12->25 injected 27 chrome.exe 12->27 injected 31 5 other processes 12->31 68 Loading BitLocker PowerShell Module 16->68 29 conhost.exe 16->29         started        signatures8 process9 dnsIp10 46 192.168.2.4, 138, 443, 49708 unknown unknown 22->46 33 chrome.exe 22->33         started        process11 dnsIp12 40 googlehosted.l.googleusercontent.com 142.250.72.129, 443, 49734, 49735 GOOGLEUS United States 33->40 42 www.google.com 142.251.35.68, 443, 49721, 49727 GOOGLEUS United States 33->42 44 clients2.googleusercontent.com 33->44
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/55717f1860706ae2447e0912146162ba199d4e9d56cc4e059478179fc27c2e5f
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55717f1860706ae2447e0912146162ba199d4e9d56cc4e059478179fc27c2e5f/
Verdict:
Malicious
Threat:
Family.PUREHVNC
Link:
https://tip.neiki.dev/file/55717f1860706ae2447e0912146162ba199d4e9d56cc4e059478179fc27c2e5f
Threat name:
ByteCode-MSIL.Trojan.PureLogsStealer
Create hunting rule
Status:
Malicious
First seen:
2026-01-15 10:06:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kvyx6gdaobvoerd6bejbiylcximz2tu5k3ge4bmupalz7qt4fzpq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
316ea2aefdf2539f5cf1fdf4ac483725a708a658b98996e9dfdef48f95475de0
PureLogsStealer
55717f1860706ae2447e0912146162ba199d4e9d56cc4e059478179fc27c2e5f
PureLogsStealer
8e6c00c7c8e3624067e5a24cadb921e2f46ee7cd21f3521c80702327de7e4583
PureLogsStealer
9661b801f59b8752ec8cb232a705495b4cc0e42eb7b3d0197e948aaca66c3c6e
PureLogsStealer
d52c8f228648acf0a42f78f887e5cc15bc5f37ac587345b0050ddf44c5e26a37
PureLogsStealer
e24766de77521a19f2820e0cde95ef9b3171636f93c1da7901ab074218a0e36c
PureLogsStealer
error
PureLogsStealer
+ 25 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
collection discovery execution spyware stealer
Link:
https://tria.ge/reports/260115-l4n63sax8g/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f0dbed6a-be5d-4ab9-80d5-5d5ed6475c52
Unpacked files
SH256 hash:
55717f1860706ae2447e0912146162ba199d4e9d56cc4e059478179fc27c2e5f
MD5 hash:
60637fc5c912dfd517b8cf0ffc76e720
SHA1 hash:
3d0b11817ab58f6f85f4183b789bf76b9e751fc0
Link:
https://www.unpac.me/results/85688118-3bfa-444f-8de4-4021c57cad7f/
SH256 hash:
c17eb3c125fcc8d37c9dcc5a66c89b2da5cb668ebc331ebf450314cc02c3c170
MD5 hash:
d7c27c9244a4a0c64391adba9f7eeb5d
SHA1 hash:
aab9ab8af152a136f0c44f746f977193c9d90c71
Link:
https://www.unpac.me/results/85688118-3bfa-444f-8de4-4021c57cad7f/
SH256 hash:
38551e7119a33faba6141ae4592ebb01f0b7fe99196313671d5af7d2c1541a42
MD5 hash:
096a95b2870f7d72353626addc112c13
SHA1 hash:
b471e5b6419336c226731c4f9aabaafdc6a9ff49
Link:
https://www.unpac.me/results/85688118-3bfa-444f-8de4-4021c57cad7f/
SH256 hash:
bb919065249c299bd293332dc238212cc241e0923b617701d08e3d3f685ebde7
MD5 hash:
7f7f1c552d671561db1bf609475b5c65
SHA1 hash:
e722c413a72a5d79bbca2fa703beb94097bcf036
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/85688118-3bfa-444f-8de4-4021c57cad7f/
SH256 hash:
e7984227f4ede37cef584c98ea8e5acf4baa4fde66ae8362dd728458df6fa120
MD5 hash:
62479f3f3d5753e463fc49ed270b3bed
SHA1 hash:
cc77614c255cc8ce9b136b08168e7fdbdc1b0566
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/85688118-3bfa-444f-8de4-4021c57cad7f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/55717f186070/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/55717f1860706ae2447e0912146162ba199d4e9d56cc4e059478179fc27c2e5f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/48979/

Comments