MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5efcb3342222baab812b5dde95e6eee661fc89ccd86f5b045c7b439181f96c3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5efcb3342222baab812b5dde95e6eee661fc89ccd86f5b045c7b439181f96c3a
SHA3-384 hash: 6e62a32401efa01611ae75c98e339b989f0644d03c6a82d438869fefdaa4a5122852e5f2d62a9b3a4851f199cb3760ff
SHA1 hash: 86d006fc4f9956a95d00ac3495ce6eac46b441bf
MD5 hash: c140865c1f149ff0fc721e233e483c0c
humanhash: don-gee-december-tennessee
File name:SecuriteInfo.com.Trojan.PackedNET.2147.13396.4452
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:642'560 bytes
First seen:2024-02-20 08:25:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:7/qaiuYQtY3NcsKYKTcyJd5hG5UG5IXqxxhk27c9cFTN7Cy:rMAtY3NbKYj5U9Xq/e2Q9cFTNe
TLSH T10AD423A85DB88211C299CA7ECB3C4962E543137B7D2134728918DB4F4BCAF14EED73A5
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
Reporter SecuriteInfoCom
Tags:exe PureLogStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
279
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
kelihos
Create hunting rule
ID:
1
File name:
bomb.exe
Verdict:
Malicious activity
Analysis date:
2024-01-14 14:52:55 UTC
Tags:
payload opendir kelihos trojan loader tofsee botnet purplefox backdoor phorpiex stealer redline miner phishing evasion guloader nitol stealc rat asyncrat remote vidar agenttesla risepro xworm
Link:
https://app.any.run/tasks/5945e9e8-ba4a-4d54-8d01-09fce95a3a82

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
zgRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/476974/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2147.13396.4452.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/65d4622103a1c3a7aef1fdff/reports/2cb2f045-3d10-4d91-8fb7-7ac076be27aa/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/5efcb3342222baab812b5dde95e6eee661fc89ccd86f5b045c7b439181f96c3a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/586f9904-c00d-48c1-ab3d-593fd7a5b8db
Result
Threat name:
PureLog Stealer, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1395116
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Costura Assembly Loader
Yara detected PureLog Stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5efcb3342222baab812b5dde95e6eee661fc89ccd86f5b045c7b439181f96c3a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5efcb3342222baab812b5dde95e6eee661fc89ccd86f5b045c7b439181f96c3a/
Threat name:
ByteCode-MSIL.Trojan.Bsymem
Create hunting rule
Status:
Malicious
First seen:
2023-09-16 09:57:28 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
1
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l36lgnbcek5kxajllxpjlzxo4zq7zcom3bxvwbc4pnbzdapznq5a._file
Verdict:
malicious
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:zgrat rat
Link:
https://tria.ge/reports/240220-kbv89aed69/
Behaviour
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
5efcb3342222baab812b5dde95e6eee661fc89ccd86f5b045c7b439181f96c3a
MD5 hash:
c140865c1f149ff0fc721e233e483c0c
SHA1 hash:
86d006fc4f9956a95d00ac3495ce6eac46b441bf
Link:
https://www.unpac.me/results/deea1920-c877-419e-8460-9eee9f01dadf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5efcb3342222baab812b5dde95e6eee661fc89ccd86f5b045c7b439181f96c3a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PureLogsStealer

Executable exe 5efcb3342222baab812b5dde95e6eee661fc89ccd86f5b045c7b439181f96c3a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2684962/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/476974/

Comments