MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a79af4c702d0ab607cdc438bf9af01203f20a258a4d58948f7ee8dc43153a008. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
PureLogsStealer
Vendor detections: 6
| SHA256 hash: | a79af4c702d0ab607cdc438bf9af01203f20a258a4d58948f7ee8dc43153a008 |
|---|---|
| SHA3-384 hash: | f5169cb94e347837bf50f6e1428f31a23efeefac98f82930ac9c942b4d9eaacc64375b19b4d0ed004baf76a0e71bd564 |
| SHA1 hash: | e9b2bec4622cc09382e3cd314ac084e2b3301a06 |
| MD5 hash: | 36d4f4a10afc5ae9e5de0ac818ce86d9 |
| humanhash: | blossom-carbon-golf-nevada |
| File name: | IRS NOTICE 2025.bat |
| Download: | download sample |
| Signature | PureLogsStealer |
| File size: | 2'690'194 bytes |
| First seen: | 2026-02-20 22:18:15 UTC |
| Last seen: | Never |
| File type: |  bat |
| MIME type: | text/plain |
| ssdeep | 24576:6LnkYATkxrOLnkYATkxrLuFnRhi+3cVoaP/DKOPjL0x9wUVyZE15F:3swUIZE15F |
| TLSH | T12CC585A665907D30230EE377AA8AD4A4377232EAB5140F987F56D9CB31F80B750CC6E5 |
| Magika | batch |
| Reporter |  smica83 |
| Tags: | bat PureLogsStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
40
Origin country :
HUVendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
92.5%
Tags:
autorun dropper extens sage
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Verdict:
Unknown
File Type:
text.html
Result
Threat name:
DonutLoader, PureLog Stealer, ResolverRA
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for dropped file
Antivirus detection for URL or domain
Command shell drops VBS files
Compiles code to access protected / encrypted code
Found large BAT file
Found many strings related to Crypto-Wallets (likely being stolen)
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Silenttrinity Stager Msbuild Activity
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Unusual module load detection (module proxying)
Uses dynamic DNS services
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
WScript reads language and country specific registry keys (likely country aware script)
Yara detected DonutLoader
Yara detected PureLog Stealer
Yara detected ResolverRAT
Behaviour
Behavior Graph:
Score:
53%
Verdict:
Susipicious
File Type:
SCRIPT
Gathering data
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.73
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.