MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b61f479b41cbe22f801be4689f1d00123208cf9f1b2e8afd50b7f784fdba6898. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b61f479b41cbe22f801be4689f1d00123208cf9f1b2e8afd50b7f784fdba6898
SHA3-384 hash: a193d9c411441c0de48e1960f6c8467b64fb67b7285757571e36e02511ed96d74c14ff2f5aae0587119ea4327baa8f5f
SHA1 hash: 02c395de6ee3f74635117235b1ce8ffa07e5ac7d
MD5 hash: 55508d207e4fc0cd70ac16f11b267375
humanhash: delta-may-cola-cat
File name:SecuriteInfo.com.Variant.Genie.8DN.1756.11734.32204
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:782'336 bytes
First seen:2026-01-06 07:21:50 UTC
Last seen:2026-01-06 08:23:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'693 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 12288:MQOjWVC8M2Vh5UqUoryJ3MR/TaWzdgqP2aymmNVwUvCT3HuN2kx2:oWk87aqFyO1mWjgm2Pv+Xr
TLSH T1D4F4F15033A9DA02D4A29FF41571E37447BCAE9DA920D3478EE6ACEFB539B016C10793
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe PureLogsStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
139
Origin country :
FR FR
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0ab82020-7684-426f-8c5f-d063e08499a0/
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Genie.8DN.1756.11734.32204
Verdict:
Malicious activity
Analysis date:
2026-01-06 07:25:11 UTC
Tags:
stealer purecrypter purehvnc netreactor
Link:
https://app.any.run/tasks/efa407a9-13b4-464f-aac8-c8f5242888b1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/47808/
Detection(s):
SecuriteInfo.com.Variant.Genie.8DN.1756.11734.32204.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=695cb826d2357cccc3dfe258
Tags:
agenttesla virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook krypt packed unsafe
Link:
https://www.filescan.io/uploads/695cb8246c350eb0b6f62399/reports/46838a1c-9954-4e0c-b29e-7a748e4fad3a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b61f479b41cbe22f801be4689f1d00123208cf9f1b2e8afd50b7f784fdba6898
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-06T02:51:00Z UTC
Last seen:
2026-01-08T04:58:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/b61f479b41cbe22f801be4689f1d00123208cf9f1b2e8afd50b7f784fdba6898/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9a66b3cb-b855-453c-8ff3-e719349b24cc
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b61f479b41cbe22f801be4689f1d00123208cf9f1b2e8afd50b7f784fdba6898
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.40 Win 32 Exe x86
Link:
https://app.malva.re/file/55508d207e4fc0cd70ac16f11b267375
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b61f479b41cbe22f801be4689f1d00123208cf9f1b2e8afd50b7f784fdba6898/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2026-01-06 05:48:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
14 of 24 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wypupg2bzprc7aa34ruj6hiacizart47dmxiv7kqw73yj7n2ncma._file
Verdict:
malicious
Label(s):
unc_loader_078
Create hunting rule
Similar samples:
error
PureLogsStealer
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection discovery spyware stealer
Link:
https://tria.ge/reports/260106-h9n7gsdq2z/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b5626489-87d9-41e5-a46c-f199b7421581
Unpacked files
SH256 hash:
b61f479b41cbe22f801be4689f1d00123208cf9f1b2e8afd50b7f784fdba6898
MD5 hash:
55508d207e4fc0cd70ac16f11b267375
SHA1 hash:
02c395de6ee3f74635117235b1ce8ffa07e5ac7d
Link:
https://www.unpac.me/results/c6dfc946-b315-4680-ac1c-31262de6675d/
SH256 hash:
4aa5fe48fe5a44c9f458c095344bf070af3f7114cfcd7781569f43e678601650
MD5 hash:
0a4b294e5e2559de86a39d0755c51570
SHA1 hash:
317fde9f9380c809f0a53f4028c40b1bbcfa28c7
Link:
https://www.unpac.me/results/c6dfc946-b315-4680-ac1c-31262de6675d/
SH256 hash:
daa5b4c469e20763bac04a0468a18cc2c773a4884345f04061c46dbfec7cba6d
MD5 hash:
68bae860c569549779ef78c833669eb1
SHA1 hash:
20bb93b63f4f2b5fe6033cc6d0dd37511f172809
Link:
https://www.unpac.me/results/c6dfc946-b315-4680-ac1c-31262de6675d/
SH256 hash:
e59636c65db0d2b650564f0396ff5a7992927e6231eead794262875b233e4845
MD5 hash:
6cc7ac40276208bed5a22ee3125cc490
SHA1 hash:
e9761b5b0678084fc20e96c6b82a81712b34b983
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/c6dfc946-b315-4680-ac1c-31262de6675d/
Parent samples :
4e7553e3a78871ad5e545201d8ae2d707528b78f34d22e039b7756bffe729a70
0a0638f9263e4f3312c5127ec06523300819773ff71b469e2812a00e45d2ec9e
75502289cbeab9a85f706095edc47c28b729155b4a094bf75adaa9aedab361ce
b61f479b41cbe22f801be4689f1d00123208cf9f1b2e8afd50b7f784fdba6898
f051ccaa5bc22f73cd8fa340f40f102bb0372684c6f3a5160c43fe7211cf1d25
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b61f479b41cb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
zgRAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b61f479b41cbe22f801be4689f1d00123208cf9f1b2e8afd50b7f784fdba6898

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/47808/

Comments