MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e17f553220905c179fb636a60e8cac9b29f2fb67d41cf86d8cef8a7c24e5d936. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e17f553220905c179fb636a60e8cac9b29f2fb67d41cf86d8cef8a7c24e5d936
SHA3-384 hash: 9685c92c7e382cd4a70122dad0d2e5713f5fc547f25a22136ede789d695cb73a78987d80fb2171434cd42c47115e324f
SHA1 hash: 95a61938ea99ea740476d451d5c642e617292cf4
MD5 hash: cfb48c2cab273fcebb11028b7ce449fa
humanhash: alanine-aspen-bravo-robin
File name:Trump Family-Linked American Bitcoin Doubles Revenue in Q3 Amid Aggressive Mining Expansion.lnk
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:2'914 bytes
First seen:2025-11-16 14:40:53 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/x-ms-shortcut
ssdeep 48:8/Haxwc+hlG7whpvjuw9drj0dDvB68DvBV:8/H4wLU7wntzEvBvvBV
TLSH T1AA51191CBED50226E6A6EA35BCB66216E57E3B43E73E4D8D41C14284067201EB46DF2E
Magika lnk
Reporter smica83
Tags:lnk

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
HU HU
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28759.LnkHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.KingForADaypshell.20231121.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.KingForADaymshta.20231121.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6919e291bdb0ec3a9dc2565b
Tags:
obfuscate autorun xtreme shell
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/e17f553220905c179fb636a60e8cac9b29f2fb67d41cf86d8cef8a7c24e5d936/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade powershell
Link:
https://www.filescan.io/uploads/6919e29053bda2a5d9f6c9c9/reports/183ee67c-2585-475a-bb2a-42abd1591b8c/overview
Verdict:
Malicious
Labled as:
CMD:BZC.YAX.Pantera.41
Link:
https://www.hybrid-analysis.com/sample/e17f553220905c179fb636a60e8cac9b29f2fb67d41cf86d8cef8a7c24e5d936
Verdict:
Malicious
File Type:
lnk
First seen:
2025-11-16T10:45:00Z UTC
Last seen:
2025-11-16T23:45:00Z UTC
Hits:
~10
Detections:
Trojan.WinLNK.Agent.sb HEUR:Trojan.WinLNK.Powecod.e HEUR:Trojan.Multi.Powedon.a
Link:
https://opentip.kaspersky.com/e17f553220905c179fb636a60e8cac9b29f2fb67d41cf86d8cef8a7c24e5d936/results?tab=lookup
Result
Threat name:
PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1814890
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Bypasses PowerShell execution policy
Creates HTA files
Detected unpacking (creates a PE file in dynamic memory)
Drops PE files with benign system names
Drops script or batch files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Drops script at startup location
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to harvest and steal Bitcoin Wallet information
Windows shortcut file (LNK) starts blacklisted processes
Writes to foreign memory regions
Yara detected Powershell download and execute
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1814890 Sample: Trump Family-Linked America... Startdate: 16/11/2025 Architecture: WINDOWS Score: 100 60 harry-site.nl 2->60 62 bg.microsoft.map.fastly.net 2->62 80 Suricata IDS alerts for network traffic 2->80 82 Malicious sample detected (through community Yara rule) 2->82 84 Windows shortcut file (LNK) starts blacklisted processes 2->84 86 21 other signatures 2->86 10 powershell.exe 14 20 2->10         started        15 cmd.exe 2->15         started        signatures3 process4 dnsIp5 64 harry-site.nl 46.30.215.110, 443, 49690, 49691 ONECOMDK Denmark 10->64 50 C:\Users\user\AppData\Local\Temp\a.hta, HTML 10->50 dropped 104 Windows shortcut file (LNK) starts blacklisted processes 10->104 106 Suspicious powershell command line found 10->106 108 Found many strings related to Crypto-Wallets (likely being stolen) 10->108 110 4 other signatures 10->110 17 mshta.exe 1 10->17         started        20 powershell.exe 23 10->20         started        22 conhost.exe 1 10->22         started        24 svchost.exe 15->24         started        26 conhost.exe 15->26         started        file6 signatures7 process8 signatures9 68 Windows shortcut file (LNK) starts blacklisted processes 17->68 70 Suspicious powershell command line found 17->70 28 powershell.exe 34 17->28         started        72 Loading BitLocker PowerShell Module 20->72 74 Writes to foreign memory regions 24->74 76 Allocates memory in foreign processes 24->76 78 Injects a PE file into a foreign processes 24->78 32 InstallUtil.exe 24->32         started        34 WerFault.exe 24->34         started        process10 file11 52 C:\Users\user\AppData\Local\...\svchost.exe, PE32+ 28->52 dropped 54 C:\Users\user\AppData\...\VCRUNTIME140_1.dll, PE32+ 28->54 dropped 56 C:\Users\user\AppData\...\VCRUNTIME140.dll, PE32+ 28->56 dropped 58 C:\Users\user\AppData\Local\...\MSVCP140.dll, PE32+ 28->58 dropped 112 Loading BitLocker PowerShell Module 28->112 36 svchost.exe 1 28->36         started        40 conhost.exe 28->40         started        signatures12 process13 file14 48 C:\Users\user\AppData\Roaming\...\svchost.bat, DOS 36->48 dropped 88 Detected unpacking (creates a PE file in dynamic memory) 36->88 90 Drops script or batch files to the startup folder 36->90 92 Writes to foreign memory regions 36->92 94 2 other signatures 36->94 42 InstallUtil.exe 2 36->42         started        46 WerFault.exe 36->46         started        signatures15 process16 dnsIp17 66 158.220.88.136, 49704, 56001 LEVANTISCH Switzerland 42->66 96 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 42->96 98 Found many strings related to Crypto-Wallets (likely being stolen) 42->98 100 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 42->100 102 3 other signatures 42->102 signatures18
Verdict:
Malware
YARA:
3 match(es)
Tags:
Batch Command DeObfuscated Execution: CMD in LNK Execution: PowerShell in LNK LNK LOLBin LOLBin:powershell.exe Malicious PowerShell PowerShell Call T1059.001 T1059.003 T1202: Indirect Command Execution T1204.002
Link:
https://app.malva.re/file/cfb48c2cab273fcebb11028b7ce449fa
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e17f553220905c179fb636a60e8cac9b29f2fb67d41cf86d8cef8a7c24e5d936/
Verdict:
Malicious
Threat:
Family.ZGRAT
Link:
https://tip.neiki.dev/file/e17f553220905c179fb636a60e8cac9b29f2fb67d41cf86d8cef8a7c24e5d936
Threat name:
Win32.Trojan.Pantera
Create hunting rule
Status:
Malicious
First seen:
2025-11-16 13:44:31 UTC
File Type:
Binary
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4f7vkmrasbobph5wg2ta5dfmtmu7f63h2qopq3mm56fhyjhf3e3a._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery execution
Link:
https://tria.ge/reports/251116-r2kzjatmg1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware Config
Dropper Extraction:
https://harry-site.nl/uitvaart/tf.txt
Malware family:
QuirkyLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e17f55322090/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e17f553220905c179fb636a60e8cac9b29f2fb67d41cf86d8cef8a7c24e5d936

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_PowerShell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to powershell inside an lnk file, which is suspicious

File information

The table below shows additional information about this malware sample such as delivery method and external references.

PureLogsStealer

Shortcut (lnk) lnk e17f553220905c179fb636a60e8cac9b29f2fb67d41cf86d8cef8a7c24e5d936

(this sample)

PureLogsStealer

HTML Application (hta) hta c56eada17d6c1dc11aef7339b2976be7fd74fbc531d1ffe360ee144316681f72

  
Dropping
MD5 f7aa4fc3a6c964522752102e9818f0cc
  
Dropping
SHA256 c56eada17d6c1dc11aef7339b2976be7fd74fbc531d1ffe360ee144316681f72

Comments