🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e96a1a22361a7316b24f3efd0a8854fdbec57cd9e268096f1e4e8a449c25682. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e96a1a22361a7316b24f3efd0a8854fdbec57cd9e268096f1e4e8a449c25682
SHA3-384 hash: ee355a89de15913d962d344b95d9f0f370b0315aee0f3c93a8eb54bf442a26ebea59297bda010907cf08efbf3f045340
SHA1 hash: 0d3dd7c170f3f6bfcca8ca4163ba895149f51caf
MD5 hash: cc4799b0c655a3d1d26efdd4f8e3622a
humanhash: carbon-triple-alaska-apart
File name:5e96a1a22361a7316b24f3efd0a8854fdbec57cd9e268096f1e4e8a449c25682
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'501'184 bytes
First seen:2026-11-09 07:48:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
ssdeep 24576:XkQqqmVF73kdVGzYDpYcPmV+pimpu0eXUOfo6uRGqPOS:0QO7UdVTpY6vN80eXLwJ5
TLSH T178651208324ECE07D4B587F41870F7B917786D99A870C30B8EE6BDEB7936711990929B
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon b270ccbaf0e4d4d4 (7 x Formbook, 1 x AgentTesla, 1 x MassLogger)
Reporter adrian__luca
Tags:exe PureLogsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
cc4799b0c655a3d1d26efdd4f8e3622a
Verdict:
Malicious activity
Analysis date:
2026-10-06 06:45:25 UTC
Tags:
netreactor stealer
Link:
https://app.any.run/tasks/ecd7629e-9f8e-4e44-bd1b-ebc6b8159102

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/98117/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1c2791492c978625a66c2
Tags:
infosteal injection injected shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Connecting to a non-recommended domain
Connection attempt
Adding an exclusion to Microsoft Defender
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/5e96a1a22361a7316b24f3efd0a8854fdbec57cd9e268096f1e4e8a449c25682
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-04T23:31:00Z UTC
Last seen:
2026-11-05T03:58:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/5e96a1a22361a7316b24f3efd0a8854fdbec57cd9e268096f1e4e8a449c25682/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ae10a547-55eb-4f4c-a81f-c8fe7f56b6ad
Result
Threat name:
PureLogs Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2003428
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected MSIL Injector
Yara detected PureLogs Stealer
Behaviour
Behavior Graph:
Download SVG
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.30 Win 64 Exe x64
Link:
https://app.malva.re/file/cc4799b0c655a3d1d26efdd4f8e3622a
Detection:
purelogs
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5e96a1a22361a7316b24f3efd0a8854fdbec57cd9e268096f1e4e8a449c25682/
Threat name:
Win64.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2026-10-05 07:08:51 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
25
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l2lkdirdmgttc2ze6px5bkefj7n6yv6ntytibfxr4tukisock2ba._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/261109-jnr7padf75/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Malware Family:
n/a
Verdict:
Malicious
Tags:
injector evasion
YARA:
ConventionEngine_Keyword_Client ConventionEngine_Term_Desktop pe_no_import_table ConventionEngine_Term_Users
Link:
https://app.threat.zone/submission/cc9d910c-1088-468c-ade5-3d9c31bdd8e2
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
polymorphic dotnet debugger-check exec-delay peexe 64bit
Link:
https://intel.virussign.com/intelligence/file/5e96a1a22361a7316b24f3efd0a8854fdbec57cd9e268096f1e4e8a449c25682
Unpacked files
SH256 hash:
5e96a1a22361a7316b24f3efd0a8854fdbec57cd9e268096f1e4e8a449c25682
MD5 hash:
cc4799b0c655a3d1d26efdd4f8e3622a
SHA1 hash:
0d3dd7c170f3f6bfcca8ca4163ba895149f51caf
Link:
https://www.unpac.me/results/c8c83635-9828-41f9-926c-ffd5acf5322c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5e96a1a22361/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/5e96a1a22361a7316b24f3efd0a8854fdbec57cd9e268096f1e4e8a449c25682

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/98117/

Comments