MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8b7aecce2a4d00f209b1e4d30128ba6ef0f83bbdc05127f6f8ba97e7d6df291. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

pure

Vendor detections: 7

Intelligence 7 IOCs YARA 8 File information Comments

SHA256 hash:	b8b7aecce2a4d00f209b1e4d30128ba6ef0f83bbdc05127f6f8ba97e7d6df291
SHA3-384 hash:	1cd1206e7e9c90ee36b35b3c758239497f46bc8b56d65069ad22d06db97c5999ae4f0a2585753bf41552992ed0d92315
SHA1 hash:	f44c5c2c3b5e985b3d49726db36aa5e9eb3f83fa
MD5 hash:	e997e8ddbeee64b579fde8bfd18c281c
humanhash:	white-uniform-juliet-equal
File name:	Installer.iso
Download:	download sample
Signature	pure Create hunting rule
File size:	14'682'112 bytes
First seen:	2026-03-01 12:17:17 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	196608:mVMh8BzDH03Ke6hV6As2EbMfFqu+5F/6ieVnibzczcGcezKey2nnFOEbdjVFKF11:xiDH0Ws6gu+iiIiXczDzKeJVVkUqSq
TLSH	T10DE633AA7526E473CC772A7A5996D633C749FC07A1F3512C7F2CB252923241AB4F1B20
TrID	88.7% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Magika	iso
Reporter	aachum
Tags:	iso pure purecrypter PureLogsStealer

iamaachum

https://dl89sfilesbase.top/downloads/Ay9kfhTwsnG/AppSetup

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	ReadMe.txt
File size:	761 bytes
SHA256 hash:	8dac22f984bff8e1162b63065ed3b990b44fe9b7a2da940ca3a6053c202a1bc3
MD5 hash:	ff0400d5397036ff353727a5f9941455
MIME type:	text/plain
Signature	pure

File name:	Installer_v2173_x64_.exe
File size:	14'627'840 bytes
SHA256 hash:	4a8751808fdf81e5819fd4c299bf1dd09547c938f63721e3820623bd8771a6cc
MD5 hash:	311f2c70d74c92ebb8b694046f5332c2
MIME type:	application/x-dosexec
Signature	pure

Vendor Threat Intelligence

Malware configuration found for:

Details

Result

Malware family:

n/a

Score:

9/10

Tags:

defense_evasion execution persistence themida trojan

Link:

https://tria.ge/reports/260301-rtrgcadx7b/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Looks up external IP address via web service

Checks BIOS information in registry

Executes dropped EXE

Themida packer

Command and Scripting Interpreter: PowerShell

Looks for VMWare Tools registry key

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/b8b7aecce2a4d00f209b1e4d30128ba6ef0f83bbdc05127f6f8ba97e7d6df291

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)