🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9bf01982168407700434d699816d6f427bf9ece8d54824bdbd01b06b7f36be9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9bf01982168407700434d699816d6f427bf9ece8d54824bdbd01b06b7f36be9
SHA3-384 hash: f15c4fa50389e6fa1235e75d8b541257ad94189eafe4ef6ff89922982f75254390391b713b7b5124c82830c809c9ca07
SHA1 hash: d15dfe2fabbb39c4a72e14c4384627b5e17024c4
MD5 hash: 91c497e9315245e1909a9bab08346b96
humanhash: washington-snake-table-spaghetti
File name:our revised order qty for PO - 4500352886.js
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'410'072 bytes
First seen:2026-08-20 07:57:30 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:6/C+F+paQJA+Y/TkDpJyXGc1bOpJW0wqygGBT7aGhnFZweKXZcU5:q8+LkC2c1bavMjhFWh
TLSH T1026512F0DE418CA437398B2ED56AD6981FED46C8311DE4DFAE1828B05779BD7E81301A
Magika batch
Reporter abuse_ch
Tags:js PureLogsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
148
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Win32.SuspectCrc.6688.7710.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac659dcdb181a66dc07333a
Tags:
emotet xtreme shell sage
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a9bf01982168407700434d699816d6f427bf9ece8d54824bdbd01b06b7f36be9
Result
Threat name:
PureLogs Stealer
Create hunting rule
Detection:
malicious
Classification:
evad.troj.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1960998
Signature
.NET source code contains process injector
.NET source code references suspicious native API functions
Compiles code for process injection (via .Net compiler)
Creates a thread in another existing process (thread injection)
Found suspicious powershell code related to unpacking or dynamic code loading
Hijacks the control flow in another process
Injects a PE file into a foreign processes
JavaScript file contains suspicious strings
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Unusual module load detection (module proxying)
Uses attrib.exe to hide files
Uses cmd line tools excessively to alter registry or file data
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected PureLogs Stealer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1960998 Sample: our revised order qty for P... Startdate: 20/08/2026 Architecture: WINDOWS Score: 100 105 Malicious sample detected (through community Yara rule) 2->105 107 Multi AV Scanner detection for submitted file 2->107 109 Yara detected PureLogs Stealer 2->109 111 8 other signatures 2->111 10 cmd.exe 4 2->10         started        14 wscript.exe 1 1 2->14         started        16 wscript.exe 2->16         started        18 svchost.exe 2->18         started        process3 dnsIp4 89 C:\Users\user\...\gdi_fontmap_KENWNXLX.cmd, DOS 10->89 dropped 91 C:\Users\user\AppData\...\gdi_fontmap.dat, DOS 10->91 dropped 149 Wscript starts Powershell (via cmd or directly) 10->149 151 Uses cmd line tools excessively to alter registry or file data 10->151 21 powershell.exe 10->21         started        25 powershell.exe 13 10->25         started        27 conhost.exe 10->27         started        35 4 other processes 10->35 153 JScript performs obfuscated calls to suspicious functions 14->153 155 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->155 157 Suspicious execution chain found 14->157 29 cmd.exe 1 14->29         started        31 powershell.exe 8 14->31         started        159 WScript reads language and country specific registry keys (likely country aware script) 16->159 33 cmd.exe 16->33         started        95 127.0.0.1 unknown unknown 18->95 file5 signatures6 process7 file8 77 C:\Users\user\AppData\Local\...\amlfzmrj.0.cs, Unicode 21->77 dropped 79 C:\Users\user\AppData\...\02cdu0em.cmdline, Unicode 21->79 dropped 81 C:\Users\user\...\gdi_fontmap_SLUKYSQX.vbs, ASCII 21->81 dropped 121 Writes to foreign memory regions 21->121 123 Maps a DLL or memory area into another process 21->123 125 Creates a thread in another existing process (thread injection) 21->125 127 Loading BitLocker PowerShell Module 21->127 37 msiexec.exe 2 21->37         started        40 csc.exe 3 21->40         started        43 csc.exe 3 21->43         started        53 2 other processes 21->53 129 Suspicious powershell command line found 29->129 131 Wscript starts Powershell (via cmd or directly) 29->131 133 Uses attrib.exe to hide files 29->133 45 powershell.exe 16 29->45         started        47 conhost.exe 29->47         started        83 C:\Users\user\AppData\Local\...\MusNotify.cmd, DOS 31->83 dropped 135 Found suspicious powershell code related to unpacking or dynamic code loading 31->135 137 Compiles code for process injection (via .Net compiler) 31->137 49 conhost.exe 31->49         started        139 Uses cmd line tools excessively to alter registry or file data 33->139 51 conhost.exe 33->51         started        55 3 other processes 33->55 signatures9 process10 file11 113 Hijacks the control flow in another process 37->113 115 Writes to foreign memory regions 37->115 117 Creates a thread in another existing process (thread injection) 37->117 119 Injects a PE file into a foreign processes 37->119 57 prevhost.exe 14 3 37->57         started        85 C:\Users\user\AppData\Local\...\02cdu0em.dll, PE32 40->85 dropped 61 cvtres.exe 1 40->61         started        87 C:\Users\user\AppData\Local\...\amlfzmrj.dll, PE32 43->87 dropped 63 cvtres.exe 1 43->63         started        signatures12 process13 dnsIp14 97 2.27.62.123, 4449, 49763, 49764 VPSLAB-NETWORKSID Germany 57->97 141 Writes to foreign memory regions 57->141 143 Creates a thread in another existing process (thread injection) 57->143 145 Injects a PE file into a foreign processes 57->145 147 Unusual module load detection (module proxying) 57->147 65 chrome.exe 57->65         started        68 chrome.exe 57->68 injected 70 chrome.exe 57->70 injected 72 4 other processes 57->72 signatures15 process16 dnsIp17 93 192.168.2.5, 138, 443, 4449 unknown unknown 65->93 74 chrome.exe 65->74         started        process18 dnsIp19 99 www.google.com 142.251.152.119, 443, 49770, 49771 GOOGLE-GoogleLLCUS United States 74->99 101 mobile-gtalk.l.google.com 142.251.179.188, 49780, 5228 GOOGLE-GoogleLLCUS United States 74->101 103 3 other IPs or domains 74->103
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a9bf01982168407700434d699816d6f427bf9ece8d54824bdbd01b06b7f36be9
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
PowerShell
Link:
https://app.malva.re/file/91c497e9315245e1909a9bab08346b96
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9bf01982168407700434d699816d6f427bf9ece8d54824bdbd01b06b7f36be9/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-20 01:29:06 UTC
File Type:
Text (Batch)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vg7qdgbbnbahoacdjvuzqfww6qt37hworvkies632anqnn7tnpuq._file
Verdict:
malicious
Label(s):
PureCrypter
Create hunting rule
Link:
https://reports.threatray.com/dbc39ebb-1881-4608-b942-28d372f74e75
Result
Malware family:
n/a
Score:
  8/10
Tags:
collection defense_evasion discovery execution
Link:
https://tria.ge/reports/260820-jt9c6asdqg/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
outlook_office_path
outlook_win_path
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Executes a command shell one-liner
System Time Discovery
Accesses Microsoft Outlook profiles
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments