MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71d46630eb726648735f2bfa628fd03d06389335e0befd05ca6da226748df8a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 71d46630eb726648735f2bfa628fd03d06389335e0befd05ca6da226748df8a4
SHA3-384 hash: ac04e4be7265a37cdce3ebdd21a20d2854ca49f1a24da6e1b2c0570e1addc3117fc548f70a715803547957972a6274b6
SHA1 hash: 2920bc4a082dd6e4cad9ab8a08642e79bab278b8
MD5 hash: 54dfd654156cc7436c5919ead36333f6
humanhash: fillet-yellow-emma-massachusetts
File name:INQUIRY SPM-241254700.js
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:2'707'375 bytes
First seen:2026-08-12 08:19:27 UTC
Last seen:2026-08-12 12:07:13 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:19RW86uS0OTvh7K5ieKljpmoH7BTGZe03jPrY48Dj8yyxl2MtiEuwb:t
TLSH T12BC578F09B40DCD0D82F5A32997E7B54F2391277DBCD5ACC0244FAD02DB7A45A90E98A
Magika javascript
Reporter abuse_ch
Tags:js PureLogsStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Rogue.0hr.20260812-1033.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm attrib attrib cmd encrypted evasive lolbin obfuscated powershell powershell repaired whoami whoami
Link:
https://www.filescan.io/uploads/6a7c2ce2f5523a0610ee28af/reports/873c8b32-fa2f-48ff-8c7a-c2fde1acff73/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/71d46630eb726648735f2bfa628fd03d06389335e0befd05ca6da226748df8a4
Verdict:
Malicious
File Type:
js
First seen:
2026-08-11T19:10:00Z UTC
Last seen:
2026-08-12T05:13:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/71d46630eb726648735f2bfa628fd03d06389335e0befd05ca6da226748df8a4/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad.spyw.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1956657
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking mutex)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Multi AV Scanner detection for submitted file
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses attrib.exe to hide files
Uses cmd line tools excessively to alter registry or file data
Uses whoami command line tool to query computer and username
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected MSIL Injector
Yara detected Powershell decode and execute
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1956657 Sample: INQUIRY SPM-241254700.js Startdate: 12/08/2026 Architecture: WINDOWS Score: 100 117 Multi AV Scanner detection for submitted file 2->117 119 Yara detected MSIL Injector 2->119 121 Yara detected UAC Bypass using CMSTP 2->121 123 6 other signatures 2->123 9 cmd.exe 2->9         started        12 wscript.exe 1 2 2->12         started        15 cmd.exe 1 2->15         started        process3 file4 147 Wscript starts Powershell (via cmd or directly) 9->147 149 Uses cmd line tools excessively to alter registry or file data 9->149 17 powershell.exe 9->17         started        20 conhost.exe 9->20         started        22 attrib.exe 9->22         started        30 2 other processes 9->30 79 C:\Users\user\...\ApplicationFrameHost.cmd, DOS 12->79 dropped 151 JScript performs obfuscated calls to suspicious functions 12->151 153 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->153 155 Suspicious execution chain found 12->155 157 WScript reads language and country specific registry keys (likely country aware script) 12->157 24 cmd.exe 1 12->24         started        159 Uses attrib.exe to hide files 15->159 26 powershell.exe 18 15->26         started        28 conhost.exe 15->28         started        signatures5 process6 signatures7 95 Writes to foreign memory regions 17->95 97 Creates a thread in another existing process (thread injection) 17->97 99 Injects a PE file into a foreign processes 17->99 32 prevhost.exe 17->32         started        101 Wscript starts Powershell (via cmd or directly) 24->101 36 powershell.exe 16 24->36         started        38 conhost.exe 24->38         started        40 cmd.exe 4 26->40         started        process8 dnsIp9 81 2.27.62.123, 4449, 49750, 49751 VPSLAB-NETWORKSID Germany 32->81 103 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 32->103 105 Tries to steal Mail credentials (via file / registry access) 32->105 107 Tries to harvest and steal browser information (history, passwords, etc) 32->107 115 5 other signatures 32->115 43 chrome.exe 32->43         started        46 chrome.exe 32->46 injected 48 chrome.exe 32->48 injected 59 2 other processes 32->59 109 Found suspicious powershell code related to unpacking or dynamic code loading 36->109 50 cmd.exe 1 36->50         started        75 C:\Users\user\...\usb_enum_JPOQIFMX.cmd, DOS 40->75 dropped 77 C:\Users\user\AppData\Local\...\usb_enum.cfg, DOS 40->77 dropped 111 Wscript starts Powershell (via cmd or directly) 40->111 113 Uses cmd line tools excessively to alter registry or file data 40->113 53 powershell.exe 35 40->53         started        55 conhost.exe 40->55         started        57 powershell.exe 40->57         started        61 4 other processes 40->61 file10 signatures11 process12 dnsIp13 83 192.168.2.5, 138, 443, 4449 unknown unknown 43->83 85 192.168.2.7 unknown unknown 43->85 87 192.168.2.9 unknown unknown 43->87 63 chrome.exe 43->63         started        125 Wscript starts Powershell (via cmd or directly) 50->125 66 powershell.exe 15 50->66         started        69 conhost.exe 50->69         started        127 Writes to foreign memory regions 53->127 129 Uses whoami command line tool to query computer and username 53->129 131 Creates a thread in another existing process (thread injection) 53->131 133 Injects a PE file into a foreign processes 53->133 71 prevhost.exe 53->71         started        73 whoami.exe 53->73         started        signatures14 process15 dnsIp16 89 www.google.com 142.251.151.119, 443, 49756, 49758 GOOGLE-GoogleLLCUS United States 63->89 91 mobile-gtalk.l.google.com 142.251.16.188, 49768, 5228 GOOGLE-GoogleLLCUS United States 63->91 93 3 other IPs or domains 63->93 135 Found evasive API chain (may stop execution after checking mutex) 66->135 137 Found API chain indicative of debugger detection 66->137 139 Found suspicious powershell code related to unpacking or dynamic code loading 66->139 141 Uses whoami command line tool to query computer and username 66->141 143 Unusual module load detection (module proxying) 71->143 145 Switches to a custom stack to bypass stack traces 71->145 signatures17
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/71d46630eb726648735f2bfa628fd03d06389335e0befd05ca6da226748df8a4
Verdict:
Malware
YARA:
1 match(es)
Tags:
DeObfuscated Obfuscated T1027 T1059.005 VBScript
Link:
https://app.malva.re/file/54dfd654156cc7436c5919ead36333f6
Detection:
purelogs
Create hunting rule
Link:
https://mwdb.cert.pl/sample/71d46630eb726648735f2bfa628fd03d06389335e0befd05ca6da226748df8a4/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-12 00:59:00 UTC
File Type:
Text (JavaScript)
AV detection:
6 of 36 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ohkgmmhlojteq427fp5gfd6qhuddrezv4c7p2boknwrcm5en7csa._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
collection defense_evasion discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/260812-j8rfwscr6s/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Views/modifies file attributes
outlook_office_path
outlook_win_path
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Executes a command shell one-liner
System Location Discovery: System Language Discovery
System Time Discovery
Accesses Microsoft Outlook profiles
Checks computer location settings
Creates a file in the Startup directory
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/71d46630eb726648735f2bfa628fd03d06389335e0befd05ca6da226748df8a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments