🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbbea98a875d8b00f7169dd2a53ea62a690f11e41fa84a64b480290d3988b02a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbbea98a875d8b00f7169dd2a53ea62a690f11e41fa84a64b480290d3988b02a
SHA3-384 hash: 11eecf6d0db691f99111831be918cc4f7fdfce52405b93b1c87a0b42e9a95b9d815bac04ef4481cbc90820f70f6dda3b
SHA1 hash: 546a2e91eb191c0f470839b1347b3f659bc43e4a
MD5 hash: 6ec56014f092dbf5d2bbe74b4ac8a348
humanhash: blossom-river-artist-eight
File name:New Quote PO 2000304.js
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'499'019 bytes
First seen:2026-09-17 13:01:47 UTC
Last seen:2026-09-17 19:58:32 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:RANNY4/ZJgtFgMI8Hs6ces42cdK9qP3b0UqPU0WV8nB4xPsg:Rg2rjjSPwFP1
TLSH T1BE651278FD3ED83759FDFF19BB1BDC9407F513E10ACD6268A299639523A05A0C8D2A40
Magika batch
Reporter abuse_ch
Tags:js PureLogsStealer

Intelligence

File Origin
# of uploads :
3
# of downloads :
152
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BAT.Starter.776.4677.5739.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
attrib obfuscated powershell repaired
Link:
https://www.filescan.io/uploads/6aabe4e39f76a696cafe03a7/reports/9dc02992-5e13-465b-9fe4-a8c3f05adf90/overview
Verdict:
Suspicious
Labled as:
JS/Obfuscated.CQ trojan
Link:
https://www.hybrid-analysis.com/sample/dbbea98a875d8b00f7169dd2a53ea62a690f11e41fa84a64b480290d3988b02a
Verdict:
Malicious
File Type:
js
First seen:
2026-09-17T08:24:00Z UTC
Last seen:
2026-09-17T09:48:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/dbbea98a875d8b00f7169dd2a53ea62a690f11e41fa84a64b480290d3988b02a/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1974233
Signature
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Creates processes via WMI
Found many strings related to Crypto-Wallets (likely being stolen)
Found suspicious powershell code related to unpacking or dynamic code loading
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Invoke-Obfuscation Via Stdin
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Powershell launch wmic via class
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Unusual module load detection (module proxying)
Uses attrib.exe to hide files
Uses cmd line tools excessively to alter registry or file data
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1974233 Sample: New Quote PO 2000304.js Startdate: 17/09/2026 Architecture: WINDOWS Score: 100 134 Sigma detected: Powershell launch wmic via class 2->134 136 Malicious sample detected (through community Yara rule) 2->136 138 Multi AV Scanner detection for submitted file 2->138 140 5 other signatures 2->140 12 wscript.exe 1 1 2->12         started        15 cmd.exe 2->15         started        process3 signatures4 160 JScript performs obfuscated calls to suspicious functions 12->160 162 Wscript starts Powershell (via cmd or directly) 12->162 164 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->164 170 2 other signatures 12->170 17 cmd.exe 1 12->17         started        20 powershell.exe 8 12->20         started        166 Suspicious powershell command line found 15->166 168 Uses cmd line tools excessively to alter registry or file data 15->168 23 powershell.exe 15->23         started        25 attrib.exe 15->25         started        27 attrib.exe 15->27         started        process5 file6 120 Suspicious powershell command line found 17->120 122 Wscript starts Powershell (via cmd or directly) 17->122 124 Uses cmd line tools excessively to alter registry or file data 17->124 126 Uses attrib.exe to hide files 17->126 29 powershell.exe 17->29         started        31 cmd.exe 1 17->31         started        33 cmd.exe 1 17->33         started        40 7 other processes 17->40 102 C:\Users\user\AppData\...\73469932159218.cmd, DOS 20->102 dropped 128 Found many strings related to Crypto-Wallets (likely being stolen) 20->128 130 Found suspicious powershell code related to unpacking or dynamic code loading 20->130 132 Creates processes via WMI 20->132 35 conhost.exe 20->35         started        37 cmd.exe 23->37         started        signatures7 process8 signatures9 42 powershell.exe 1 46 29->42         started        46 findstr.exe 1 31->46         started        48 findstr.exe 1 33->48         started        150 Wscript starts Powershell (via cmd or directly) 37->150 50 powershell.exe 37->50         started        52 cmd.exe 37->52         started        54 cmd.exe 37->54         started        58 6 other processes 37->58 56 findstr.exe 1 40->56         started        60 3 other processes 40->60 process10 file11 104 C:\Users\user\...\tile_db_TFOBBSWQ.cmd, DOS 42->104 dropped 106 C:\Users\user\...\tile_db_SENCINMTh.cmd, DOS 42->106 dropped 108 C:\Users\user\AppData\Local\...\tile_db.dat, DOS 42->108 dropped 152 Hijacks the control flow in another process 42->152 154 Creates an autostart registry key pointing to binary in C:\Windows 42->154 156 Writes to foreign memory regions 42->156 158 3 other signatures 42->158 62 choice.exe 14 5 42->62         started        66 conhost.exe 42->66         started        68 powershell.exe 50->68         started        70 findstr.exe 52->70         started        72 findstr.exe 54->72         started        74 findstr.exe 58->74         started        76 findstr.exe 58->76         started        78 findstr.exe 58->78         started        80 findstr.exe 58->80         started        signatures12 process13 dnsIp14 118 2.27.62.208, 4449, 49722, 49723 VPSLAB-NETWORKSID Germany 62->118 172 Unusual module load detection (module proxying) 62->172 82 conhost.exe 62->82         started        174 Hijacks the control flow in another process 68->174 176 Writes to foreign memory regions 68->176 178 Maps a DLL or memory area into another process 68->178 84 choice.exe 68->84         started        87 conhost.exe 68->87         started        signatures15 process16 signatures17 144 Writes to foreign memory regions 84->144 146 Creates a thread in another existing process (thread injection) 84->146 148 Injects a PE file into a foreign processes 84->148 89 chrome.exe 84->89         started        92 conhost.exe 84->92         started        94 chrome.exe 84->94 injected 96 3 other processes 84->96 process18 dnsIp19 116 192.168.2.6, 138, 443, 4449 unknown unknown 89->116 98 chrome.exe 89->98         started        process20 dnsIp21 110 www.google.com 142.251.154.119, 443, 49730, 49733 GOOGLE-GoogleLLCUS United States 98->110 112 mobile-gtalk.l.google.com 142.251.2.188, 49753, 5228 GOOGLE-GoogleLLCUS United States 98->112 114 5 other IPs or domains 98->114 142 Found many strings related to Crypto-Wallets (likely being stolen) 98->142 signatures22
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/dbbea98a875d8b00f7169dd2a53ea62a690f11e41fa84a64b480290d3988b02a
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dbbea98a875d8b00f7169dd2a53ea62a690f11e41fa84a64b480290d3988b02a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3o7ktcuhlwfqb5ywtxjkkpvgfjuq6eped6ueuzfuqauq2omiwava._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection defense_evasion discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/260917-p9zrjsfl2t/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Views/modifies file attributes
outlook_office_path
outlook_win_path
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Executes a command shell one-liner
System Time Discovery
Hide Artifacts: Hidden Files and Directories
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Creates a file in the Startup directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dbbea98a875d8b00f7169dd2a53ea62a690f11e41fa84a64b480290d3988b02a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments