MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b63ca22f1e89643c8fb7d2baf2b8bc324d4ac119929d444470e68f1ecec8acef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b63ca22f1e89643c8fb7d2baf2b8bc324d4ac119929d444470e68f1ecec8acef
SHA3-384 hash: 53bb585bcb3392c4a1512e59c431ed049308d54bfa8ff8aeb407f28fac961e41184c35460a7c6a2f176062f743fcd953
SHA1 hash: c68a01d2aa7fa554d469452f52e35dbabf1d41ed
MD5 hash: e515ec4afb7a6b84a4394a0fb31d1f3c
humanhash: six-mountain-spaghetti-fanta
File name:Quote Request- Project FMD2025UOS.exe
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'065'984 bytes
First seen:2025-09-09 06:40:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:PN53RkVbGAdf+A4sWK0Zd5K0LQ7aO9apITKPObOtB9YGkBeBv:1sbGkfF0KOdT0mf+TKPttrYGkB8v
TLSH T1873512142159DA07D52A9F751972F2B82FA8BFDCE412C203EFDA7EDFB035B406885291
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe PureLogsStealer


Avatar
abuse_ch
PureLogsStealer C2:
185.222.58.56:7705

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.222.58.56:7705 https://threatfox.abuse.ch/ioc/1585451/

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Quote Request- Project FMD2025UOS.exe
Verdict:
No threats detected
Analysis date:
2025-09-09 06:45:16 UTC
Tags:
anti-evasion
Link:
https://app.any.run/tasks/13875f87-b3f1-4e40-a14c-5fdd00f6fd45

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/26419/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68bfcbf0b200525988791323
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Creating a window
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/68bfcc2ca7b97e046b9345e4/reports/0ba4fa1f-e431-47c8-aed9-e17a58d88339/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b63ca22f1e89643c8fb7d2baf2b8bc324d4ac119929d444470e68f1ecec8acef
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-09T03:31:00Z UTC
Last seen:
2025-09-09T03:31:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/b63ca22f1e89643c8fb7d2baf2b8bc324d4ac119929d444470e68f1ecec8acef/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c386fd60-1352-419a-b47a-37d925761df3
Result
Threat name:
PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1773747
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b63ca22f1e89643c8fb7d2baf2b8bc324d4ac119929d444470e68f1ecec8acef
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.43 Win 32 Exe x86
Link:
https://app.malva.re/file/e515ec4afb7a6b84a4394a0fb31d1f3c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b63ca22f1e89643c8fb7d2baf2b8bc324d4ac119929d444470e68f1ecec8acef/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-09-09 06:42:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wy6kely6rfsdzd5x2k5pfof4gjguvqizskouirdq42hr5twivtxq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
error
PureLogsStealer
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250909-hf8c9shk5w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/da976ed6-fa3e-4eff-b51e-f58fb8475567
Unpacked files
SH256 hash:
b63ca22f1e89643c8fb7d2baf2b8bc324d4ac119929d444470e68f1ecec8acef
MD5 hash:
e515ec4afb7a6b84a4394a0fb31d1f3c
SHA1 hash:
c68a01d2aa7fa554d469452f52e35dbabf1d41ed
Link:
https://www.unpac.me/results/06c28408-1e28-445c-9c16-2ab0e83b94de/
SH256 hash:
12dda0cd3b378fbced3071df357733426bb09e47c31fcc3ba6273650f67895dc
MD5 hash:
773c55854eb467033abb78bc2b667f80
SHA1 hash:
54bfd694185cd257abb4ee6b477dba12b971b9b9
Link:
https://www.unpac.me/results/06c28408-1e28-445c-9c16-2ab0e83b94de/
SH256 hash:
f2ac440b1624109376d467a6d3ff026ae89463a15806a277522fd1e7455fa63b
MD5 hash:
e916dc2d805c75e0956db3b8f89cb147
SHA1 hash:
c05d38a5a22f8fb27f25c729c5ab8ea16f2e7600
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/06c28408-1e28-445c-9c16-2ab0e83b94de/
SH256 hash:
b429ee231c8e0275cd6d766fac96d26cef71fb5d3ddd5027e11c43ae1f184ebf
MD5 hash:
16bb60a86e33a95fc0a0bf881a0e8a1c
SHA1 hash:
ea6d38869f3321043a2ffe4dd929dce5f2d074cf
Link:
https://www.unpac.me/results/06c28408-1e28-445c-9c16-2ab0e83b94de/
SH256 hash:
c5e492f252bbbe8df450a22de2a4475097979fb096f629ec33d02e1476c37024
MD5 hash:
a5b94ea118f8921b645330fdecee0b50
SHA1 hash:
a3f93c0a95436fa3f753b3c1e5f3991ed1c00629
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/06c28408-1e28-445c-9c16-2ab0e83b94de/
Parent samples :
14266e901e5083d9577b8268b0de5e22d34e04693931a7fc04cbe33ed09e0d2b
b63ca22f1e89643c8fb7d2baf2b8bc324d4ac119929d444470e68f1ecec8acef
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/b63ca22f1e89643c8fb7d2baf2b8bc324d4ac119929d444470e68f1ecec8acef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/26419/

Comments