MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 664248d9fea57ef0114ec3465ffd3e76a8d75d78ed0eec336e0f588cd13e7bd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureLogsStealer

Vendor detections: 6

Intelligence 6 IOCs YARA 9 File information Comments

SHA256 hash:	664248d9fea57ef0114ec3465ffd3e76a8d75d78ed0eec336e0f588cd13e7bd9
SHA3-384 hash:	fc5fae3b8b553abe1431222a910ff6e55e38516ee2401ce3f9c68d3823830fed3fc6e9c9d7e6cd6e2840810e5ecb0ccb
SHA1 hash:	31803aaddeb246cb597182a8a8228f86a425fbd9
MD5 hash:	afc383710119cc299ba762de52fb54b1
humanhash:	hydrogen-december-iowa-wisconsin
File name:	Installer.iso
Download:	download sample
Signature	PureLogsStealer Create hunting rule
File size:	15'632'384 bytes
First seen:	2026-01-29 15:18:23 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	393216:pEQ0ZZeBx3hbfxZR134ROVrT317i5YSg0wcv1c8d:pvAMB3fxL13B31+s0wc9zd
TLSH	T15DF633EC71D54BD1D024817F1B02624FC5733DC8A6BA859CFAC933BD2B729D1289926B
TrID	88.7% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Magika	iso
Reporter	aachum
Tags:	iso purecrypter PureHVNC PureLogsStealer

iamaachum

https://dl777filesbase.top/0nj84gjs2ma0gjemfwdc4i-installer00731578ghsvbetischgh3dlpabwj3vn5rusjcb50swcg00

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	ReadMe.txt
File size:	760 bytes
SHA256 hash:	a2b18ffd6f199ad4b53b2475af68a64e771dcb1ee24d87abedb762f5980d0c42
MD5 hash:	e0f669790e02a7e490d865deb7f62905
MIME type:	text/plain
Signature	PureLogsStealer

File name:	Installer_v2703_x64.exe
File size:	15'578'624 bytes
SHA256 hash:	308efd60526b3b3cf9c64493f867c6e8b2cd3bc9b63a5eef99ea8009512f1637
MD5 hash:	518c465259818e3051a8e63678be31e7
MIME type:	application/x-dosexec
Signature	PureLogsStealer

Vendor Threat Intelligence

Malware configuration found for:

Details

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)