MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureLogsStealer

Vendor detections: 18

Intelligence 18 IOCs YARA 26 File information Comments

SHA256 hash:	63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71
SHA3-384 hash:	9a0df1e84ecaa542e2f359c6160acf0d4ba64a0013b6b385de52ee99226cb8a6ee213bfcb92cc64cf91da2dd37371361
SHA1 hash:	0f63e32b9edcd74d0d2f1bcfc05a80a30705f2db
MD5 hash:	b51bb68478daa755371b0f34fc91e5f3
humanhash:	alpha-delta-snake-football
File name:	file
Download:	download sample
Signature	PureLogsStealer Create hunting rule
File size:	496'128 bytes
First seen:	2026-02-01 14:38:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'854 x Amadey, 290 x Smoke Loader)
ssdeep	6144:Kgy+bnr+hp0yN90QEaIqHq7Lfdt3LmrXiQQRcrbtfc6sN+8UAsqFOqmu3Fe1uPxD:sMrFy90UK7rbhDc+6uhb8+DJXiQV1
TLSH	T1A5B4020BE5E89032DC64877054E705C31636FA902B599793678FED5A28B32F1B37622B
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10522/11/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-gcleaner exe f LAB.file PureLogsStealer

Bitsight

url: http://195.178.136.38/service

Intelligence

File Origin

# of uploads :

# of downloads :

161

Origin country :

Vendor Threat Intelligence

Gathering data

Malware family:

amadey

ID:

File name:

_63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.exe

Verdict:

Malicious activity

Analysis date:

2026-02-01 14:40:04 UTC

Tags:

amadey botnet stealer stealc vidar auto redline xor-url generic upx rdp

Link:

https://app.any.run/tasks/1ad24125-4475-46ed-898f-052d9ba496a5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Amadey

Link:

https://www.capesandbox.com/analysis/51100/

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

Win.Malware.Generic-10058845-0

Win.Malware.Xeu2gbl-10058901-0

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=697f656a848d0f834c8c6c0a

Tags:

autorun emotet

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context amadey amadey anti-vm base64 CAB explorer fingerprint installer installer installer-heuristic lolbin microsoft_visual_cc mikey netsh packed packed packed rundll32 runonce schtasks sfx stealer vidar wmic

Link:

https://www.filescan.io/uploads/697f6566981ff1d38a43a3bf/reports/07ded44b-e00e-4a01-aa51-fbe9383f74a2/overview

Verdict:

Malicious

Labled as:

Crifi.Generic

Link:

https://www.hybrid-analysis.com/sample/63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-02-01T11:44:00Z UTC

Last seen:

2026-02-01T13:40:00Z UTC

Hits:

~100

Detections:

BSS:Exploit.Win32.Generic Trojan-Downloader.Win32.Deyma.sb Trojan-PSW.Lumma.HTTP.Download BSS:Trojan.Win32.Generic Trojan-Downloader.PsDownload.HTTP.C&C Trojan-Downloader.Agent.HTTP.C&C VHO:Trojan-PSW.Win32.Vidar.gen Trojan-PSW.Vidar.HTTP.C&C PDM:Trojan.Win32.Generic Trojan.Nymaim.HTTP.ServerRequest Trojan-Dropper.Win32.Agent.sb VHO:Trojan-Downloader.Win32.Convagent.gen Trojan.Agentb.TCP.C&C Trojan-PSW.Win32.Vidar.hev Trojan-PSW.Win32.Vidar.d HEUR:Trojan-Downloader.Win32.Deyma.gen Trojan-Downloader.Agent.TCP.C&C

Link:

https://opentip.kaspersky.com/63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71/results?tab=lookup

Malware family:

Amadey

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b14108b7-12f0-47e8-acfa-cc6aeb253e77

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net CAB:COMPRESSION:LZX Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86

Link:

https://app.malva.re/file/b51bb68478daa755371b0f34fc91e5f3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71/

Verdict:

Malicious

Threat:

Family.AMADEY

Link:

https://tip.neiki.dev/file/63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71

Threat name:

Win32.Trojan.Amadey

Status:

Malicious

First seen:

2026-02-01 14:39:44 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

30 of 38 (78.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mpezmaar7jpyykvbxsxoo6qpheknj4l5stqqh4kx2nvqaqvzfzyq._file

Verdict:

malicious

Label(s):

amadey

Similar samples:

error

PureLogsStealer

Result

Malware family:

vidar

Score:

10/10

Tags:

family:amadey family:vidar botnet:fbf543 defense_evasion discovery execution installer persistence stealer trojan upx

Link:

https://tria.ge/reports/260201-rzy4dads3h/

Behaviour

Delays execution with timeout.exe

GoLang User-Agent

Kills process with taskkill

Modifies registry key

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

Program crash

System Location Discovery: System Language Discovery

System Time Discovery

Launches sc.exe

Enumerates processes with tasklist

UPX packed file

Adds Run key to start application

Looks up external IP address via web service

Creates new service(s)

Disables service(s)

Executes dropped EXE

Modifies file permissions

Stops running service(s)

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Amadey

Amadey family

Detects Amadey x86-bit Payload

Detects Vidar Stealer

Vidar

Vidar family

Malware Config

C2 Extraction:

http://94.154.35.25

Unpacked files

SH256 hash:

63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71

MD5 hash:

b51bb68478daa755371b0f34fc91e5f3

SHA1 hash:

0f63e32b9edcd74d0d2f1bcfc05a80a30705f2db

Link:

https://www.unpac.me/results/d0eed239-a077-4267-a1d6-20b9d5f0874c/

SH256 hash:

f99c69a781b8cbb1139e308a173ac8092f72159a1dd32a37d55ab763d8f2d94d

MD5 hash:

b9c27da0758728c0001fa48de182175c

SHA1 hash:

37cf68129996649245274402a20945be9ab8cab2

Detections:

win_amadey_auto

Amadey

Link:

https://www.unpac.me/results/d0eed239-a077-4267-a1d6-20b9d5f0874c/

Parent samples :

043411ec48a610695668589c877e96b333b1a7b2ba07304ab0776339edf61cc1
b65e358f50489d16259f50dc37d3f997990b699980798aa5430877603717ec5d
1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882
e218997cd7873f7721296a2856721c62829ee3a3a956360422c98f6424b39649
63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71
df42f9beb10f8d5b669c3c0667304819e33ba9f9240c8d3cebf294d77c65b663
cfe0b6c72f2eadaaeefe287d15ae6dfc1fc44341dfb763c60e447dca9ab6cdc5

SH256 hash:

1a47995b128b736b51d5d24c6f7efdeb33b8c53bfb39819e5bef0ed9f54dff02

MD5 hash:

17e86ed9ea9a6987f128efd3b55aefd0

SHA1 hash:

93b08a57e57614e90f16b24ff7cd2cde45d0152f

Detections:

win_amadey_auto

Amadey

Link:

https://www.unpac.me/results/d0eed239-a077-4267-a1d6-20b9d5f0874c/

Parent samples :

Malware family:

Amadey

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/63c9960011fa/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Redline_Stealer Create hunting rule
Author:	Varp0s

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	MAL_packer_lb_was_detected Create hunting rule
Author:	0x0d4y
Description:	Detect the packer used by Lockbit4.0

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ProgramLanguage_Rust Create hunting rule
Author:	albertzsigovits
Description:	Application written in Rust programming language

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	win_redline_wextract_hunting_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects wextract archives related to redline/amadey