MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a8e28b5fc5de276230406a83e84a21fdb2808b55b8877be01dadb14dc1da32d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a8e28b5fc5de276230406a83e84a21fdb2808b55b8877be01dadb14dc1da32d
SHA3-384 hash: 8368321cf29b9adc3a254653968fae688612b70384239f4955cad331bbb9e5b6f0c35a7dd83a76005f3d90557af7177b
SHA1 hash: 70728bdd1b5b099527476f73d4d6bef4a17f317d
MD5 hash: 04c226c412286f9e99b4f71f0fed04b0
humanhash: paris-missouri-glucose-hawaii
File name:8a8e28b5fc5de276230406a83e84a21fdb2808b55b887.exe
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:673'792 bytes
First seen:2025-07-23 01:40:21 UTC
Last seen:2025-07-26 11:31:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 18e40b89a55c16f27b2446b3a72b5b88 (1 x PureLogsStealer)
ssdeep 12288:8YWSyqivHvqbua0zY19El/4SdYkKMrSnDqOoi5m08nVE236J1IhjL7:xoqinoua0zY8JdYkV6m56J1IF
Threatray 158 similar samples on MalwareBazaar
TLSH T13FE422BBBF63D58FC24263F86F0546A175F0BFC54EA1BC1B8EC40C746A0E6285BA5581
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter abuse_ch
Tags:exe PureLogsStealer


Avatar
abuse_ch
PureLogsStealer C2:
144.172.91.74:7709

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
144.172.91.74:7709 https://threatfox.abuse.ch/ioc/1559618/

Intelligence

File Origin
# of uploads :
3
# of downloads :
39
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
3618e3ce63f46562cb77c0a75f031bebba0fa3e501e36b46cfe3be609d013b4b.bin.exe
Verdict:
Malicious activity
Analysis date:
2025-07-23 01:23:39 UTC
Tags:
lumma stealer themida loader amadey botnet auto-reg telegram auto generic stealc rdp hijackloader anydesk rmm-tool miner a3x payload autoit vidar deerstealer shellrunner auto-startup golang
Link:
https://app.any.run/tasks/8e8b1d07-e1ee-4fbe-a202-78c512d215ff

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/16411/
Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68803d972f623871a5f22e5c
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug explorer lolbin mingw packed
Link:
https://www.filescan.io/uploads/68803d9a12460d6954609701/reports/c933d777-1962-47d2-a8b6-5d3a3807c8cd/overview
Verdict:
Malicious
Labled as:
Win64/Agent_AGeneric.FMR trojan
Link:
https://www.hybrid-analysis.com/sample/8a8e28b5fc5de276230406a83e84a21fdb2808b55b8877be01dadb14dc1da32d
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/14c64307-b345-486d-abb6-4eda1b625b64
Result
Threat name:
PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1742398
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Benign windows process drops PE files
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1742398 Sample: 8a8e28b5fc5de276230406a83e8... Startdate: 23/07/2025 Architecture: WINDOWS Score: 100 36 release-assets.githubusercontent.com 2->36 38 rdmfile.eu 2->38 40 5 other IPs or domains 2->40 66 Suricata IDS alerts for network traffic 2->66 68 Malicious sample detected (through community Yara rule) 2->68 70 Multi AV Scanner detection for submitted file 2->70 72 2 other signatures 2->72 9 8a8e28b5fc5de276230406a83e84a21fdb2808b55b887.exe 2->9         started        12 explorer.exe 32 159 2->12         started        signatures3 process4 dnsIp5 84 Contains functionality to inject threads in other processes 9->84 86 Injects code into the Windows Explorer (explorer.exe) 9->86 88 Writes to foreign memory regions 9->88 94 2 other signatures 9->94 15 explorer.exe 48 15 9->15 injected 44 ax-0003.ax-msedge.net 150.171.28.12, 443, 49753 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 12->44 90 System process connects to network (likely due to code injection or exploit) 12->90 92 Query firmware table information (likely to detect VMs) 12->92 signatures6 process7 dnsIp8 52 144.172.91.74, 39001, 49721, 49742 HOSTFLYTE-NETWORKSCA United States 15->52 54 github.com 140.82.114.4, 443, 49749 GITHUBUS United States 15->54 56 2 other IPs or domains 15->56 34 C:\Users\user\AppData\...\oo4qaew3.gwx.exe, PE32+ 15->34 dropped 58 System process connects to network (likely due to code injection or exploit) 15->58 60 Benign windows process drops PE files 15->60 62 Tries to steal Mail credentials (via file / registry access) 15->62 64 6 other signatures 15->64 20 oo4qaew3.gwx.exe 1 15->20         started        23 chrome.exe 1 15->23         started        26 chrome.exe 15->26 injected 28 5 other processes 15->28 file9 signatures10 process11 dnsIp12 74 Antivirus detection for dropped file 20->74 76 Multi AV Scanner detection for dropped file 20->76 78 Injects code into the Windows Explorer (explorer.exe) 20->78 82 3 other signatures 20->82 42 192.168.2.4, 137, 138, 39001 unknown unknown 23->42 80 Found many strings related to Crypto-Wallets (likely being stolen) 23->80 30 chrome.exe 23->30         started        signatures13 process14 dnsIp15 46 googlehosted.l.googleusercontent.com 142.251.32.97, 443, 49734, 49735 GOOGLEUS United States 30->46 48 www.google.com 142.251.40.228, 443, 49726, 49729 GOOGLEUS United States 30->48 50 clients2.googleusercontent.com 30->50 96 Found many strings related to Crypto-Wallets (likely being stolen) 30->96 signatures16
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8a8e28b5fc5de276230406a83e84a21fdb2808b55b8877be01dadb14dc1da32d
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 64 Exe x64
Link:
https://app.malva.re/file/04c226c412286f9e99b4f71f0fed04b0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a8e28b5fc5de276230406a83e84a21fdb2808b55b8877be01dadb14dc1da32d/
Verdict:
Malicious
Threat:
Win64.Malware.Heuristic
Link:
https://tip.neiki.dev/file/8a8e28b5fc5de276230406a83e84a21fdb2808b55b8877be01dadb14dc1da32d
Threat name:
Win64.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2025-07-23 01:23:40 UTC
File Type:
PE+ (Exe)
AV detection:
7 of 36 (19.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rkhcrnp4lxrhmiyea2ud5bfcd7nsqcfvloehppqb3lnrjxa5umwq._file
Verdict:
malicious
Label(s):
donut_injector
Create hunting rule
Similar samples:
035f7fe000669479a182ef61034dc4b4dd89d15c47f830fd9c2e28f68f40c466
PureLogsStealer
201a6a8047b2621bf85356fa0ea76e3c6ce879cda9d2c5a319db5ce9e31ee8df
PureLogsStealer
86bb861acb6ef0fc7f4d5b69e7f912f9c06230a2427c7d3784199fc2be509ebf
PureLogsStealer
8a8e28b5fc5de276230406a83e84a21fdb2808b55b8877be01dadb14dc1da32d
PureLogsStealer
9ce142439e553f047639d272975b85c41da29191e532348f00653723e7f00299
PureLogsStealer
error
PureLogsStealer
+ 148 additional samples on MalwareBazaar
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader adware collection discovery loader persistence spyware
Link:
https://tria.ge/reports/250723-b3teassqz7/
Behaviour
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Browser Information Discovery
Drops file in Windows directory
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Enumerates connected drives
Executes dropped EXE
Boot or Logon Autostart Execution: Active Setup
Downloads MZ/PE file
Detects DonutLoader
DonutLoader
Donutloader family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c9700660-f163-4705-bfc5-3bb9580d0825
Unpacked files
SH256 hash:
8a8e28b5fc5de276230406a83e84a21fdb2808b55b8877be01dadb14dc1da32d
MD5 hash:
04c226c412286f9e99b4f71f0fed04b0
SHA1 hash:
70728bdd1b5b099527476f73d4d6bef4a17f317d
Link:
https://www.unpac.me/results/440c3452-abef-4c94-9589-b3e2bfb0e6f7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/8a8e28b5fc5de276230406a83e84a21fdb2808b55b8877be01dadb14dc1da32d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PureLogsStealer

Executable exe 8a8e28b5fc5de276230406a83e84a21fdb2808b55b8877be01dadb14dc1da32d

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/16411/
  
URLhaus
https://urlhaus.abuse.ch/url/3587244/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoA

Comments