MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c829ecdfad04daba449fb93106f176c5fd065f3642b70cc46ab4285246a3057d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c829ecdfad04daba449fb93106f176c5fd065f3642b70cc46ab4285246a3057d
SHA3-384 hash: d6190cd24383f518bb37241d6789b08853ee6f25595f5c30035cd0a353607353447511b26310493011b8a9ae9ef1892d
SHA1 hash: 40bb4c848b9e8843d48884ded074af0dc183778d
MD5 hash: 0bc755a061e932971b5e642b99adda04
humanhash: bulldog-blossom-pip-echo
File name:Pembayaran dikirimkan 07082026.pdf.exe
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'683'456 bytes
First seen:2026-08-10 08:24:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'190 x AgentTesla, 20'337 x Formbook, 12'364 x SnakeKeylogger)
ssdeep 24576:9ejpQLCVBx27MlptJHE1Sl5vkgRlaBte5LwynG59YGmQEx8bZ2e1V7HNUA5Vg:qSOVBo7MrrHEQ4JIr4z7EKZ/LNf
TLSH T113751240239AEE14D0A30FF40A70D7B513B46D49B921D20B9EEA7DEF783A78468593D3
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe PureLogsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c070fb54-c968-45a7-aa51-b3a21b8eb6f0/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/79427/
Detection(s):
SecuriteInfo.com.Trojan.Bladabindi.3522.7539.2790.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6a798ab7cc6dd72969925ec8/reports/3833d2dd-9ca9-4082-ad6d-931cd6d4e986/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/c829ecdfad04daba449fb93106f176c5fd065f3642b70cc46ab4285246a3057d
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-10T01:18:00Z UTC
Last seen:
2026-08-10T05:01:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/c829ecdfad04daba449fb93106f176c5fd065f3642b70cc46ab4285246a3057d/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5e6d9030-2db1-47aa-a7cc-09589572fed0
Result
Threat name:
PureLogs Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1954939
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected MSIL Injector
Yara detected PureLogs Stealer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1954939 Sample: Pembayaran dikirimkan 07082... Startdate: 10/08/2026 Architecture: WINDOWS Score: 100 56 Multi AV Scanner detection for submitted file 2->56 58 Yara detected PureLogs Stealer 2->58 60 Yara detected MSIL Injector 2->60 62 9 other signatures 2->62 8 Pembayaran dikirimkan 07082026.pdf.exe 3 2->8         started        12 Pembayaran dikirimkan 07082026.pdf.exe 2 2->12         started        process3 file4 38 Pembayaran dikirim...7082026.pdf.exe.log, ASCII 8->38 dropped 64 Found many strings related to Crypto-Wallets (likely being stolen) 8->64 66 Injects a PE file into a foreign processes 8->66 14 Pembayaran dikirimkan 07082026.pdf.exe 15 5 8->14         started        18 Pembayaran dikirimkan 07082026.pdf.exe 4 12->18         started        signatures5 process6 dnsIp7 54 46.151.182.159, 11200, 49760, 49765 GHOSTYNETWORKSUS France 14->54 68 Tries to steal Mail credentials (via file / registry access) 14->68 70 Found many strings related to Crypto-Wallets (likely being stolen) 14->70 72 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->72 80 2 other signatures 14->80 20 chrome.exe 1 14->20         started        22 chrome.exe 2 14->22 injected 74 Tries to harvest and steal browser information (history, passwords, etc) 18->74 76 Writes to foreign memory regions 18->76 78 Tries to harvest and steal Bitcoin Wallet information 18->78 24 chrome.exe 18->24         started        27 chrome.exe 18->27 injected 29 chrome.exe 18->29 injected 31 5 other processes 18->31 signatures8 process9 dnsIp10 33 chrome.exe 20->33         started        52 192.168.2.5, 11200, 138, 443 unknown unknown 24->52 36 chrome.exe 24->36         started        process11 dnsIp12 40 ogads-pa.clients6.google.com 142.250.115.95, 443, 49788, 49789 GOOGLE-GoogleLLCUS United States 33->40 42 googlehosted.l.googleusercontent.com 142.250.26.132, 443, 49782, 49783 GOOGLE-GoogleLLCUS United States 33->42 48 3 other IPs or domains 33->48 44 mobile-gtalk.l.google.com 142.250.113.188, 49831, 5228 GOOGLE-GoogleLLCUS United States 36->44 46 142.251.151.119, 443, 49806, 49807 GOOGLE-GoogleLLCUS United States 36->46 50 4 other IPs or domains 36->50
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c829ecdfad04daba449fb93106f176c5fd065f3642b70cc46ab4285246a3057d
Gathering data
Detection:
purelogs
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c829ecdfad04daba449fb93106f176c5fd065f3642b70cc46ab4285246a3057d/
Threat name:
Win32.Trojan.PowerShell
Create hunting rule
Status:
Suspicious
First seen:
2026-08-10 04:23:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zau6zx5natnlure7xeyqn4lwyx6qmxzwik3qzrdkwqufervdav6q._file
Verdict:
malicious
Label(s):
PureCrypter
Create hunting rule
Link:
https://reports.threatray.com/2db427c4-362a-4514-b37f-ccd7a1cf6453
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection discovery persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/260810-ka134svbne/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Creates a file in the Startup directory
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
c829ecdfad04daba449fb93106f176c5fd065f3642b70cc46ab4285246a3057d
MD5 hash:
0bc755a061e932971b5e642b99adda04
SHA1 hash:
40bb4c848b9e8843d48884ded074af0dc183778d
Link:
https://www.unpac.me/results/25dc289c-a0f3-4b79-8c22-e4606dd17aa9/
SH256 hash:
5211eea4e91d9fbec6c16f88f934feae8b5c659acbe8007683987a4633725d02
MD5 hash:
bfa252e70857194d7d8d1198e9acbf03
SHA1 hash:
54e1dc5bc879d2d99b60efcc8bfcc7151a2be4de
Link:
https://www.unpac.me/results/25dc289c-a0f3-4b79-8c22-e4606dd17aa9/
SH256 hash:
3330514646765d1e587cc6d41257e39a163532872ba81e672b180e13f248b466
MD5 hash:
3ba75b1549079ea29a9f1226f7200a97
SHA1 hash:
bf7ff7cca9389ba538e06450ef5ff26a95327336
Link:
https://www.unpac.me/results/25dc289c-a0f3-4b79-8c22-e4606dd17aa9/
SH256 hash:
be8b36db0dc7c872892941f2907f58a0f03347213d04ef4d34b46fed27936931
MD5 hash:
5ed1e375aece7b7729443ebb37e4e642
SHA1 hash:
ecd00a72b688482909d5c4fd30887892c8e91c97
Link:
https://www.unpac.me/results/25dc289c-a0f3-4b79-8c22-e4606dd17aa9/
SH256 hash:
42d9618e475f15b38385633fc945b3982501c146c25d08287f70afc49dcaf742
MD5 hash:
0d8f877f6a2ac450450d97fa58c7c107
SHA1 hash:
4d4b5b23e78fdaf111ad184ffc2fa7998bfe10dc
Link:
https://www.unpac.me/results/25dc289c-a0f3-4b79-8c22-e4606dd17aa9/
SH256 hash:
1af0b049aef36a7d1f83909f5049a23bf4fad8549b53624c7ebacf952b6e54ec
MD5 hash:
7cda39df2921ef6b75bbc8723976aa2d
SHA1 hash:
88f25b2db609920b911dae7d2a5d9f4eb7bc75e2
Link:
https://www.unpac.me/results/25dc289c-a0f3-4b79-8c22-e4606dd17aa9/
SH256 hash:
c98dd6e775bb9bbfd5854c6ae8ce0a44fe7a93f6d4367160f914d561c2025db1
MD5 hash:
9af11c26d12a50b581ac5455b406492f
SHA1 hash:
8c58eb1a72410519e04c786b8281f014500eaee4
Link:
https://www.unpac.me/results/25dc289c-a0f3-4b79-8c22-e4606dd17aa9/
Malware family:
PureHVNC
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c829ecdfad04/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c829ecdfad04daba449fb93106f176c5fd065f3642b70cc46ab4285246a3057d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/79427/

Comments