MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7d4341732ef5442ec456c78b82b92912cec787d884b8ec97d620358a341c7478. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
PureLogsStealer
Vendor detections: 16
| SHA256 hash: | 7d4341732ef5442ec456c78b82b92912cec787d884b8ec97d620358a341c7478 |
|---|---|
| SHA3-384 hash: | 5f059b50ab3da0278e87dbaf86aa2e20c389a850859d476d182f93f49c33331aea240492f4086f3e60411d9897d80d8a |
| SHA1 hash: | da95b43bc37b9b8e10e1642d0669f9a8be93e8bf |
| MD5 hash: | d11d8c745be508dc1fb859ea8adc9e76 |
| humanhash: | rugby-thirteen-bakerloo-july |
| File name: | Quote Request - Project FMD2025UOS.exe |
| Download: | download sample |
| Signature | PureLogsStealer |
| File size: | 1'040'384 bytes |
| First seen: | 2025-10-27 02:55:06 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 24576:IchQQwkPXWBC0Y5XLEgce4527ujjNcX/9r1amFia6vupLVjmD022e3:SQwkPmxYtEgce41OXFr1awi7vupLBmDz |
| Threatray | 505 similar samples on MalwareBazaar |
| TLSH | T1C32523953B29E807C48297B809B1F2720B793ED96112E686DFD26FDBB9D5F004D21783 |
| TrID | 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10522/11/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Magika | pebin |
| Reporter |  abuse_ch |
| Tags: | exe PureLogsStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 108.170.31.37:7705 | https://threatfox.abuse.ch/ioc/1627328/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
195
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Quote Request - Project FMD2025UOS.exe
Verdict:
Malicious activity
Analysis date:
2025-10-27 02:56:29 UTC
Tags:
stealer purecrypter purehvnc netreactor
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
70%
Tags:
malware
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
packed vbnet
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-27T00:02:00Z UTC
Last seen:
2025-10-28T05:53:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.PureLogs.TCP.C&C PDM:Trojan.Win32.Generic Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb HEUR:Trojan.MSIL.Agent.gen
Malware family:
KeyBase
Verdict:
Malicious
Result
Threat name:
PureLog Stealer
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.39 Win 32 Exe x86
Verdict:
Malicious
Threat:
Trojan.MSIL.Agent
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
unc_loader_078
xworm
katzstealer
unc_loader_037
Similar samples:
+ 495 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
collection discovery spyware stealer
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
a94300bda9189abc3b9a26ef91a92d5cb8bf05d0770f6f702f20813a6e3358c1
MD5 hash:
d6455a4f7f7db0c4280ab5ad5bc077e5
SHA1 hash:
493dc4d02ceb374e4b335c1fb74f8ca9dcd370f8
SH256 hash:
ca0b230ed9fb0561870865d1685b70bf7ca70da77cc76dac010d026d97f92006
MD5 hash:
1e74b05b0c209aae7e2bc58611fc1d44
SHA1 hash:
550c8af9ceff1df647804410d158da97707561fe
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
cecda179936fb55b1ee782f97969bad161a40377aee024102fc8df63d0329065
MD5 hash:
d55bfc37ccc6d09ff5d73708413f44e2
SHA1 hash:
b1a7d83599622e51126a080b839725535f4678fc
SH256 hash:
d68af1c37ac92327d3340f546abb8c378e412a29ac4150c46e9ff4cb590d5597
MD5 hash:
080567288977f2cf7bd35524cd1d77fa
SHA1 hash:
5d0f93f13697b3080a22756338493843de3fdfeb
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
7d4341732ef5442ec456c78b82b92912cec787d884b8ec97d620358a341c7478
MD5 hash:
d11d8c745be508dc1fb859ea8adc9e76
SHA1 hash:
da95b43bc37b9b8e10e1642d0669f9a8be93e8bf
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
zgRAT
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.