MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef370dc82d068775f3d6b49d3c6f65cdcb7efa6dd57d391ce64a3d9f81ce1fce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureLogsStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 10 File information Comments

SHA256 hash:	ef370dc82d068775f3d6b49d3c6f65cdcb7efa6dd57d391ce64a3d9f81ce1fce
SHA3-384 hash:	ba2fc0beaba3c897e645b68ad853b63fddaf81367d99855245858861e88004321759240bb03b571442a8e957b9e0cb61
SHA1 hash:	8dabd8d33e2cb20cb86d3e498bc4554b80572d4e
MD5 hash:	30979ac6385fa79b6fc67b7b952ef87e
humanhash:	shade-winter-pip-mockingbird
File name:	ef370dc82d068775f3d6b49d3c6f65cdcb7efa6dd57d391ce64a3d9f81ce1fce
Download:	download sample
Signature	PureLogsStealer Create hunting rule
File size:	1'391'104 bytes
First seen:	2026-11-09 08:20:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
ssdeep	24576:NFsEuw8hdla3FvItfeXdccypMFve6Q457oSpPKs1Dx6dGlta7dv+1Utl674:NWLdqJwpMFveQJpSs1Dq+Wtl67
TLSH	T16C55124827A5D607CD6997F92A72F23013B93EEE3921E2068FD56DEB392AF444D001D7
TrID	44.6% (.EXE) Win64 Executable (generic) (6522/11/2) 14.0% (.ICL) Windows Icons Library (generic) (2059/9) 13.8% (.EXE) OS/2 Executable (generic) (2029/13) 13.7% (.EXE) Generic Win/DOS Executable (2002/3) 13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	adrian__luca
Tags:	exe PureLogsStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-09 17:17:37 UTC

Tags:

rgbloader loader purelogs purecrypter hanghost netreactor stealer auto-startup babel

Link:

https://app.any.run/tasks/aaeda33a-7ff6-4586-a4ad-e7c6057304b5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/98391/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af1c64e1492c978625a701e

Tags:

injection virus cupi

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Creating synchronization primitives

Connecting to a non-recommended domain

Connection attempt

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/ef370dc82d068775f3d6b49d3c6f65cdcb7efa6dd57d391ce64a3d9f81ce1fce

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-16T05:23:00Z UTC

Last seen:

2026-11-02T05:55:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/ef370dc82d068775f3d6b49d3c6f65cdcb7efa6dd57d391ce64a3d9f81ce1fce/results?tab=lookup

Gathering data

Result

Threat name:

PureLogs Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2002190

Behaviour

Behavior Graph:

n/a

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.38 Win 64 Exe x64

Link:

https://app.malva.re/file/30979ac6385fa79b6fc67b7b952ef87e

Detection:

purelogs

Link:

https://mwdb.cert.pl/sample/ef370dc82d068775f3d6b49d3c6f65cdcb7efa6dd57d391ce64a3d9f81ce1fce/

Threat name:

Win64.Trojan.MassLogger

Status:

Malicious

First seen:

2026-10-16 09:32:33 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

27 of 36 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=543q3sbna2dxl46wwsoty33fzxfx56tn2v6tshhgji6z7aood7ha._file

Result

Malware family:

n/a

Score:

7/10

Tags:

collection discovery persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/261109-j8592sv15r/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Time Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Creates a file in the Startup directory

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Malware Family:

n/a

Verdict:

Malicious

Tags:

injector evasion stealer

YARA:

pe_no_import_table

Link:

https://app.threat.zone/submission/5a68e521-d822-458d-ae27-8fb651445ccf

Malware Family:

msil

Malicious:

True

Tags:

dotnet peexe polymorphic 64bit

Link:

https://intel.virussign.com/intelligence/file/ef370dc82d068775f3d6b49d3c6f65cdcb7efa6dd57d391ce64a3d9f81ce1fce

Unpacked files

SH256 hash:

ef370dc82d068775f3d6b49d3c6f65cdcb7efa6dd57d391ce64a3d9f81ce1fce

MD5 hash:

30979ac6385fa79b6fc67b7b952ef87e

SHA1 hash:

8dabd8d33e2cb20cb86d3e498bc4554b80572d4e

Link:

https://www.unpac.me/results/e5d7062b-c5e9-42f1-916a-e82c8ad3f378/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.91

Link:

https://yomi.yoroi.company/submissions/ef370dc82d068775f3d6b49d3c6f65cdcb7efa6dd57d391ce64a3d9f81ce1fce

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DotNet_RGB_Embedded_AssemblyLoader_Hunt Create hunting rule
Author:	ShadowOpCode
Description:	Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	HUNT_NET_Loader_ImagePixel_To_AssemblyLoad Create hunting rule
Author:	Anish Bogati
Description:	Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	VIGIA_Formbook_17e263ff Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	b2bcacf7-0124-4f63-ad19-69b0102fe4c4 - Conjunctive sample-specific and variant indicators
Reference:	https://vigia.bisite.es/

Rule name:	VIGIA_RemcosRAT_e53b23f6 Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	RemcosRAT indicators with an original-sample recovery pathway
Reference:	https://vigia.bisite.es/

Rule name:	WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Derialock (pe, etat extrait)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/98391/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample