🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ab746c4d9cdf67824e417c5178b0c7c76236422a4387bd5260004e749ca3b68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ab746c4d9cdf67824e417c5178b0c7c76236422a4387bd5260004e749ca3b68
SHA3-384 hash: aa95b83d3aff8de820acf574be2b5ce87c79c781d2078b0c5e4d4e0d6b3a6d0021d6ef646797beb5d4c8fa7b3cc29a2b
SHA1 hash: e8d8e8c0a9993e7da8785e1a47dfe4ff92d056f4
MD5 hash: d0fcf46104dc14d0cb6cbdf7e8547181
humanhash: william-zebra-carolina-beryllium
File name:WHT2607011 177CASASS107987 MEDUY6440091.js
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:2'756'865 bytes
First seen:2026-08-13 11:34:17 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 49152:sVYfId+z0dVdnr2MVNSSda7NIBi9KbQX1Fv0zoU:C
TLSH T1EED5F9B09DAD3D93B6D1CC7EF623A0727E627E60D56365A250A9231701EF4F0C893927
Magika javascript
Reporter abuse_ch
Tags:js PureLogsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac5b470c9e7eb94aa78ac8a
Tags:
shell virus sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm attrib attrib base64 cmd encrypted evasive lolbin obfuscated powershell powershell repaired whoami whoami
Link:
https://www.filescan.io/uploads/6a7dabcef123f291001b66f5/reports/76b8f551-f5c7-4e53-ae27-7d4ebb2d05c1/overview
Verdict:
Suspicious
Labled as:
TR/Malware
Link:
https://www.hybrid-analysis.com/sample/5ab746c4d9cdf67824e417c5178b0c7c76236422a4387bd5260004e749ca3b68
Verdict:
Malicious
File Type:
js
First seen:
2026-08-12T06:45:00Z UTC
Last seen:
2026-08-13T21:34:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/5ab746c4d9cdf67824e417c5178b0c7c76236422a4387bd5260004e749ca3b68/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad.spyw.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1957443
Signature
.NET source code references suspicious native API functions
Creates a thread in another existing process (thread injection)
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking mutex)
Found stalling execution ending in API Sleep call
Found suspicious powershell code related to unpacking or dynamic code loading
Hijacks the control flow in another process
Injects a PE file into a foreign processes
JScript performs obfuscated calls to suspicious functions
Loading BitLocker PowerShell Module
Multi AV Scanner detection for submitted file
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses attrib.exe to hide files
Uses cmd line tools excessively to alter registry or file data
Uses whoami command line tool to query computer and username
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1957443 Sample: WHT2607011 177CASASS107987 ... Startdate: 13/08/2026 Architecture: WINDOWS Score: 100 125 Multi AV Scanner detection for submitted file 2->125 127 Yara detected UAC Bypass using CMSTP 2->127 129 Yara detected Powershell decode and execute 2->129 131 2 other signatures 2->131 9 cmd.exe 2 2->9         started        12 cmd.exe 1 2->12         started        14 wscript.exe 1 2 2->14         started        process3 file4 147 Wscript starts Powershell (via cmd or directly) 9->147 149 Uses cmd line tools excessively to alter registry or file data 9->149 17 powershell.exe 9->17         started        20 conhost.exe 9->20         started        22 attrib.exe 9->22         started        30 2 other processes 9->30 24 powershell.exe 12->24         started        26 conhost.exe 12->26         started        79 C:\Users\user\AppData\Local\...\Music.UI.cmd, DOS 14->79 dropped 151 JScript performs obfuscated calls to suspicious functions 14->151 153 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->153 155 Suspicious execution chain found 14->155 157 WScript reads language and country specific registry keys (likely country aware script) 14->157 28 cmd.exe 1 14->28         started        signatures5 process6 signatures7 93 Hijacks the control flow in another process 17->93 95 Writes to foreign memory regions 17->95 97 Creates a thread in another existing process (thread injection) 17->97 99 Injects a PE file into a foreign processes 17->99 32 prevhost.exe 17->32         started        36 cmd.exe 24->36         started        101 Wscript starts Powershell (via cmd or directly) 28->101 103 Uses attrib.exe to hide files 28->103 39 powershell.exe 16 28->39         started        41 conhost.exe 28->41         started        process8 dnsIp9 81 2.27.62.123, 4449, 49729, 49730 VPSLAB-NETWORKSID Germany 32->81 105 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 32->105 107 Tries to steal Mail credentials (via file / registry access) 32->107 109 Tries to harvest and steal browser information (history, passwords, etc) 32->109 123 4 other signatures 32->123 43 chrome.exe 32->43         started        46 chrome.exe 32->46 injected 48 chrome.exe 32->48 injected 59 3 other processes 32->59 75 C:\Users\user\...\usb_enum_VMJBFFVT.cmd, DOS 36->75 dropped 77 C:\Users\user\AppData\Local\...\usb_enum.cfg, DOS 36->77 dropped 111 Wscript starts Powershell (via cmd or directly) 36->111 113 Uses cmd line tools excessively to alter registry or file data 36->113 50 powershell.exe 33 36->50         started        53 conhost.exe 36->53         started        55 powershell.exe 36->55         started        61 4 other processes 36->61 115 Found evasive API chain (may stop execution after checking mutex) 39->115 117 Found API chain indicative of debugger detection 39->117 119 Found suspicious powershell code related to unpacking or dynamic code loading 39->119 121 Uses whoami command line tool to query computer and username 39->121 57 cmd.exe 1 39->57         started        file10 signatures11 process12 dnsIp13 83 192.168.2.4 unknown unknown 43->83 85 192.168.2.7, 138, 443, 4449 unknown unknown 43->85 63 chrome.exe 43->63         started        133 Hijacks the control flow in another process 50->133 135 Writes to foreign memory regions 50->135 137 Uses whoami command line tool to query computer and username 50->137 141 3 other signatures 50->141 66 prevhost.exe 50->66         started        69 whoami.exe 1 50->69         started        139 Wscript starts Powershell (via cmd or directly) 57->139 71 powershell.exe 15 57->71         started        73 conhost.exe 57->73         started        signatures14 process15 dnsIp16 87 android.l.google.com 142.250.217.142, 443, 49760 GOOGLE-GoogleLLCUS United States 63->87 89 www.google.com 142.251.156.119, 443, 49735, 49736 GOOGLE-GoogleLLCUS United States 63->89 91 5 other IPs or domains 63->91 143 Found stalling execution ending in API Sleep call 66->143 145 Unusual module load detection (module proxying) 66->145 signatures17
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5ab746c4d9cdf67824e417c5178b0c7c76236422a4387bd5260004e749ca3b68
Verdict:
Malware
YARA:
1 match(es)
Tags:
DeObfuscated Obfuscated T1027 T1059.005 VBScript
Link:
https://app.malva.re/file/d0fcf46104dc14d0cb6cbdf7e8547181
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ab746c4d9cdf67824e417c5178b0c7c76236422a4387bd5260004e749ca3b68/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-12 14:26:32 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lk3unrgzzx3hqjhec7crpcympr3cgzbcuq4hxvjgaacoosokhnua._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
collection defense_evasion discovery execution
Link:
https://tria.ge/reports/260813-nptjcsxvbw/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Views/modifies file attributes
outlook_office_path
outlook_win_path
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Executes a command shell one-liner
System Time Discovery
Accesses Microsoft Outlook profiles
Checks computer location settings
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5ab746c4d9cdf67824e417c5178b0c7c76236422a4387bd5260004e749ca3b68

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments