MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec58efce6d4d8e30f4100c0b38defd36b7210b1282ad6a0a3e4d167a9751b9db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ec58efce6d4d8e30f4100c0b38defd36b7210b1282ad6a0a3e4d167a9751b9db
SHA3-384 hash:	3309efdacdc8c42e7230892da691a8fcc0ca7c43aceb5338be7efcf5e2d93b44fc2e15a5bc38a9aa12e333ec853acfff
SHA1 hash:	903eb6a92f31223c734803577ac05c1904dfb5a7
MD5 hash:	2fe02003bda5ec631a91f8413b2c47c3
humanhash:	asparagus-solar-saturn-robin
File name:	ShippingXdocumentsXOrderXNo.X1010036193.rar
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	118'726 bytes
First seen:	2026-06-12 21:53:35 UTC
Last seen:	2026-06-12 21:53:37 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	1536:cYZIHDtAU7q12DCpP8cWi8kWfFUuhJ9qA9K8Jb3f01jUBXnJE8rj3oVt6PEu9Xaz:FZ+Ol81i8kWfXhv9KOyUhJEyD7kMbg
TLSH	T10DC312577BC14C90EDBDC838B9C1F2BAA85FA44A844E5EE79856871CB66012F21783DC
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	PureLogsStealer rar

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

88

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Shipping documents Order No. 1010036193.js
File size:	856'854 bytes
SHA256 hash:	cef42618c684a86091d21e8b3e7a406fa030b64596b84cf3e13f9c26e46c0fcb
MD5 hash:	0cb10ef1da21b22298935b2320bf5d92
MIME type:	text/plain
Signature	PureLogsStealer

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e281beb2-6ea2-4571-8d83-71ef5de7401b/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a27d8cb34eaf30d8ce432be

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

conhost masquerade obfuscated powershell repaired

Link:

https://www.filescan.io/uploads/6a2c803f1f652d68657bf66f/reports/23aed998-22e0-4e46-918c-873460d9e527/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ec58efce6d4d8e30f4100c0b38defd36b7210b1282ad6a0a3e4d167a9751b9db

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-09T14:39:00Z UTC

Last seen:

2026-06-09T14:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ec58efce6d4d8e30f4100c0b38defd36b7210b1282ad6a0a3e4d167a9751b9db/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ec58efce6d4d8e30f4100c0b38defd36b7210b1282ad6a0a3e4d167a9751b9db/

ReversingLabs TitaniumCloud Script-JS.Trojan.Redirector

Threat name:

Script-JS.Trojan.Redirector

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-09 09:17:18 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

18 of 36 (50.00%)

Threat level:

  5/5

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ec58efce6d4d8e30f4100c0b38defd36b7210b1282ad6a0a3e4d167a9751b9db