MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0807755b7d9de2f4412d21720b7735a175c7d3fd965fc0258056eb20e748697. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b0807755b7d9de2f4412d21720b7735a175c7d3fd965fc0258056eb20e748697
SHA3-384 hash:	222db1778dd568f76711b22fffab113965279e7b877c731ff774f38df3b9f58b855a2e13d42383be58158311c1088992
SHA1 hash:	6e04044f37c814265e289b02674f146afe758f11
MD5 hash:	170783ff55b264d833ff33d44db9c8c2
humanhash:	mississippi-crazy-football-vegan
File name:	PO#367328911.rar
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	29'283 bytes
First seen:	2026-08-21 10:15:16 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	768:CyXsDAObJviwmNA+Y+nIFnrgW2gXKlz8uq7v80rByI6h2l:yAmJvkA+YbuWXeAvdl6h2l
TLSH	T123D2F2E776AEDD4180253DD304DB555B9F902ECF27E7E4488A59338123189FE860CBC1
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	proxylife
Tags:	PureLogsStealer rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

74

Origin country :

RU

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	PO#367328911.js
File size:	804'332 bytes
SHA256 hash:	c76c5db604b23374c0255afc58865b7a1a5c55ca36800026795a8a8d8269c62b
MD5 hash:	4a0bb301c8f23548012d4215565ae353
MIME type:	text/plain
Signature	PureLogsStealer

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7b048199-6aa5-419d-bda8-85a2d75da2cc/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Other.Malware-gen.76658483.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Rogue.0hr.20260819-0732.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader encrypted evasive obfuscated repaired

Link:

https://www.filescan.io/uploads/6a88253f6304c65efd5ac18d/reports/d8b5c27f-0ef4-409a-8f4b-ce45cfda0d75/overview

Hybrid Analysis HEUR/Suspar.Generic

Verdict:

Suspicious

Labled as:

HEUR/Suspar.Generic

Link:

https://www.hybrid-analysis.com/sample/b0807755b7d9de2f4412d21720b7735a175c7d3fd965fc0258056eb20e748697

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/170783ff55b264d833ff33d44db9c8c2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b0807755b7d9de2f4412d21720b7735a175c7d3fd965fc0258056eb20e748697/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-19 03:40:15 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

10 of 23 (43.48%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wcahovnx3hpc6ras2ilsbn3tlilvy7j73fs7yasyavxledtuq2lq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery execution persistence privilege_escalation ransomware spyware stealer

Link:

https://tria.ge/reports/260821-mqpfcscp6y/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Time Discovery

Accesses Microsoft Outlook profiles

Adds Run key to start application

Checks computer location settings

Creates a file in the Startup directory

Executes dropped EXE

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/b0807755b7d9de2f4412d21720b7735a175c7d3fd965fc0258056eb20e748697