MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab
SHA3-384 hash: a3a6f261f4d9f7704cdab38ee913b5fd7c82060de8cdce0cc066ed21e55fbb1e1abcddffe921045a5a73de87d190580b
SHA1 hash: 60ded5cd8df92b2b6cd32ce94f095e9dddd93b36
MD5 hash: 93b2869c836bc38d392633bb2eb7f597
humanhash: ink-neptune-mexico-two
File name:ORDER-023674-KM436JK-2025.exe
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:990'208 bytes
First seen:2025-12-18 08:50:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:vae/KNoaj6JRFC5LPxv1ySmGVzOb6vmIT+3J3qFEYwCVbaUpM5bpc49qQiOJdgG3:vRQoa+ILPlUgQItVuUq5l9RiWGxJGF
TLSH T1972512D05FA9EB16CC310B714AA4DD7672B09F28A454F8E79DDEAF5732D9300A408F1A
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe PureLogsStealer


Avatar
abuse_ch
PureLogsStealer C2:
198.135.48.127:7705

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
198.135.48.127:7705 https://threatfox.abuse.ch/ioc/1682344/

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/38302dc4-4f04-48ac-a241-9373fb1e22fa/
Malware family:
n/a
ID:
1
File name:
ORDER-023674-KM436JK-2025.exe
Verdict:
Malicious activity
Analysis date:
2025-12-18 08:50:36 UTC
Tags:
stealer purecrypter netreactor purehvnc
Link:
https://app.any.run/tasks/924c7ffd-dbfa-48b5-aaa2-1fbf1371f6e2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45386/
Verdict:
Clean
Score:
82.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6943c04e4d2b81828c3b8c4d
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
barys krypt masquerade packed vbnet
Link:
https://www.filescan.io/uploads/6943c04ce126b9ff43868aed/reports/a44ca2bc-bd43-400c-862f-d7d8b781fbf1/overview
Verdict:
Malicious
Labled as:
Barys.Generic
Link:
https://www.hybrid-analysis.com/sample/7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-18T05:43:00Z UTC
Last seen:
2025-12-20T04:40:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.MSIL.PureLogs.sb PDM:Trojan.Win32.Generic Trojan.MSIL.Crypt.sb Trojan-PSW.Win32.Disco.sb Trojan-PSW.PureLogs.TCP.C&C HEUR:Trojan.MSIL.Taskun.gen Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb VHO:Trojan-PSW.Win32.ReaderDB.gen Trojan-PSW.Win32.Coins.sb Trojan-PSW.MSIL.Stealer.sb
Link:
https://opentip.kaspersky.com/7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f17595e2-a08c-4105-8beb-845e0c79ac85
Result
Threat name:
PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1835481
Signature
.NET source code contains potential unpacker
Creates a thread in another existing process (thread injection)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.39 Win 32 Exe x86
Link:
https://app.malva.re/file/93b2869c836bc38d392633bb2eb7f597
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab/
Verdict:
Malicious
Threat:
VHO:Trojan.MSIL.Taskun
Link:
https://tip.neiki.dev/file/7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2025-12-18 08:44:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pwrwl3tp42htmhs4sgdk6p7uvemqd5aj5iun24xcbums433yqcvq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/251223-px9e8aype1/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d6ce065a-6796-4499-80ee-51fc6cc2c5ad
Unpacked files
SH256 hash:
7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab
MD5 hash:
93b2869c836bc38d392633bb2eb7f597
SHA1 hash:
60ded5cd8df92b2b6cd32ce94f095e9dddd93b36
Link:
https://www.unpac.me/results/84d07c82-e209-43e6-9595-cbfd4adbe976/
SH256 hash:
a24ebc50c6ad99ae2efad2c0c05d4ae3657e21401334e68af512f6baf150c985
MD5 hash:
37af996ebdb1726cf6783e66580626a9
SHA1 hash:
08d3381f5d19b4730915eb616c468e804eb81a6c
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/84d07c82-e209-43e6-9595-cbfd4adbe976/
Parent samples :
7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab
1ffdf7d60a9ea155e01520d12ebfadbdca8b62d99ff925245c184499b34a75f5
957ab5ff285cb072d03de9cb8438820bde79ce9dfb59400a5b98dd45f6baa50e
1e0df0b7ddd6821d54ecf37db6a67d267387bf56751a8dfc036896b266c2d1bd
89c232f0c040e54ae9568871262eadec3164ef6ccd10529792c7b949f98b25f4
ac9650718cb2712fb1a511c349fc2e5fb85092329d33c15f4d63fef310151aff
SH256 hash:
2a29ed59c7956f0dab7a124fb30e11735373ce667d13d5a6fb5c53dbed43f767
MD5 hash:
292da2dd6c50ed0d54958a125026ad4b
SHA1 hash:
187262242bf262277a8e0f33f49ede97a3fdf2b4
Link:
https://www.unpac.me/results/84d07c82-e209-43e6-9595-cbfd4adbe976/
SH256 hash:
59767e76e33b9b1f3545e502508c5884cc6c44b7336ac9eeacbb22e816353a2f
MD5 hash:
47df6ca06989804f45cb0492478a3854
SHA1 hash:
c66840ce6395322134f2232fb2f3490f12e0430c
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/84d07c82-e209-43e6-9595-cbfd4adbe976/
SH256 hash:
0a7ebf420d32973a031cabd6d636d3199085cd25b0453f5c4c82e3845e7b279a
MD5 hash:
a0270e78766a8a58e2bf21967c67ef9a
SHA1 hash:
f09c76ba2ae46f2fab3a7f21643be750c74a4312
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/84d07c82-e209-43e6-9595-cbfd4adbe976/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7da365ee6fe6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
zgRAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7da365ee6fe68f361e5c9186af3ff4a91901f409ea28dd72e20d192e6f7880ab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/45386/

Comments