MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65668f7a2703ec132bfc0e5f3ea577b024478e24e2b9acfb3cdec64731bf2b14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureLogsStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	65668f7a2703ec132bfc0e5f3ea577b024478e24e2b9acfb3cdec64731bf2b14
SHA3-384 hash:	4ba2aaeade806a20db136e0a13aab1d214ee6f535f0d4cddfce753e067759c568f0f2653e6f368577543a593848bb24a
SHA1 hash:	f0a412f55dbbfe93b294f4cf6fa5fc4414d02f27
MD5 hash:	77ba53e871098304c7d99c6c92f49978
humanhash:	crazy-ten-sierra-spring
File name:	IMG00329_0032900 DE0003 Rechnung -R003020.vbs
Download:	download sample
Signature	PureLogsStealer Create hunting rule
File size:	14'579'562 bytes
First seen:	2026-06-30 09:47:24 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/csv
ssdeep	192:LG8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8G8l:7VjgVfiRHpDvbNO4Eyc1O
TLSH	T1BFE6A6D3C78F026051B50FD341B2970C796196B23E76B0E547A3268CFB59A8B8D94BE3
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	Decio1
Tags:	PureLogsStealer vbs

Decio1

Delivered via fake invoce email subject: "Ihre Mahnung MN.Nr-29769-R298913DE" & dropbox link
https://www.dropbox.com/scl/fi/8b3lb136mwn27au0pve38/IMG00329_0032900-DE0003-Rechnung-R003020.vbs?rlkey=k83z77ccrzfvqzd1xlg56vyrr&st=40o2hlu8&dl=1&_sm_nck=1

https://blue-paper-f69f.acrypters.workers.dev

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/72494/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a4390ba86bc95245bfada30

Tags:

autoit emotet

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a4390b2b861dcdb37ed9a77/reports/6525ccf2-9001-4200-a50f-f42e1078f6ff/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/65668f7a2703ec132bfc0e5f3ea577b024478e24e2b9acfb3cdec64731bf2b14

Verdict:

Malicious

File Type:

text

First seen:

2026-06-30T06:33:00Z UTC

Last seen:

2026-06-30T06:33:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/65668f7a2703ec132bfc0e5f3ea577b024478e24e2b9acfb3cdec64731bf2b14/results?tab=lookup

Gathering data

Detection:

purelogs

Link:

https://mwdb.cert.pl/sample/65668f7a2703ec132bfc0e5f3ea577b024478e24e2b9acfb3cdec64731bf2b14/

Verdict:

Malicious

Threat:

Trojan.VBS.SAgent

Link:

https://tip.neiki.dev/file/65668f7a2703ec132bfc0e5f3ea577b024478e24e2b9acfb3cdec64731bf2b14

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mvti66rhapwbgk74bzpt5jlxwasepdre4k42z6z433deomn7fmka._file

Result

Malware family:

n/a

Score:

10/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/260630-lsgymact9j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/65668f7a2703ec132bfc0e5f3ea577b024478e24e2b9acfb3cdec64731bf2b14

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)