MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f26b15aa89c33b3ceabfdbd1e2dbc1a1759587add95183baba90ca4d0607d6d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureLogsStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 7 File information Comments

SHA256 hash:	f26b15aa89c33b3ceabfdbd1e2dbc1a1759587add95183baba90ca4d0607d6d2
SHA3-384 hash:	0d5f270cdba2c31d891dfa70ed675fd668b8716ab5840efd31796aa785f9ed8ad5a096cf84d5d125fdbc5c794ebd5063
SHA1 hash:	85e94cd8816fbf04766aeca538657e55d0ff812c
MD5 hash:	7ae9d64c120cf88a5d8079ec2542ca93
humanhash:	johnny-apart-lithium-oscar
File name:	DELIVERY ORDER HOLD BL NO. MEDUGZ048034 18X40 JPFL FILMS PVT LTD.exe
Download:	download sample
Signature	PureLogsStealer Create hunting rule
File size:	66'048 bytes
First seen:	2025-09-25 08:36:05 UTC
Last seen:	2025-10-09 14:44:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	1536:jqFca7c9rCoIUQM8sLTeXlGMsro8hDqw9dkj7IuXJFYDgn:Uc5+UQMqlGNk8hDqI87IufYS
Threatray	376 similar samples on MalwareBazaar
TLSH	T1C2536B1CF7AE9222D76C497ADCE19904D3B8C6B2720AF32B4DE552BD38067E5D500F92
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	cocaman
Tags:	exe PureLogsStealer

Intelligence

File Origin

# of uploads :

# of downloads :

137

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

DELIVERY ORDER HOLD BL NO. MEDUGZ048034 18X40 JPFL FILMS PVT LTD.exe

Verdict:

No threats detected

Analysis date:

2025-09-25 09:23:15 UTC

Tags:

anti-evasion

Link:

https://app.any.run/tasks/491cc2c7-ef5c-460e-add3-29254b362d72

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/28955/

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68d54ecacc9425144151dfcd

Tags:

micro virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade obfuscated obfuscated obfuscated

Link:

https://www.filescan.io/uploads/68d4ff6874e5a2898992981d/reports/164b8a0f-2a7c-4ba4-b58b-2a51b7f9cc80/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/f26b15aa89c33b3ceabfdbd1e2dbc1a1759587add95183baba90ca4d0607d6d2

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-09-24T08:08:00Z UTC

Last seen:

2025-09-24T08:08:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/f26b15aa89c33b3ceabfdbd1e2dbc1a1759587add95183baba90ca4d0607d6d2/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/7231abb1-ee3d-40ed-bd49-bbac2a117e44

Result

Threat name:

PureLog Stealer

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1783876

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected Costura Assembly Loader

Yara detected PureLog Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f26b15aa89c33b3ceabfdbd1e2dbc1a1759587add95183baba90ca4d0607d6d2

Verdict:

inconclusive

YARA:

9 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.43 Win 32 Exe x86

Link:

https://app.malva.re/file/7ae9d64c120cf88a5d8079ec2542ca93

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f26b15aa89c33b3ceabfdbd1e2dbc1a1759587add95183baba90ca4d0607d6d2/

Threat name:

Win32.Infostealer.Tinba

Status:

Malicious

First seen:

2025-09-24 11:24:33 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

28 of 38 (73.68%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6jvrlkujym5tz2v73pi6fw6buf2zlb5n3fiyhov2sdfe2bqh23ja._file

Verdict:

malicious

Label(s):

katzstealer

purecrypter

PureLogsStealer

15c4f381e82e4d4d24ddd1f3ca33cf16678933534da2e5c27f67ec7ece8b7509

PureLogsStealer

1d6a54881c5c2cf4a712697ac4a91ae19f5a04de92ed652882c175fa2ce91bf2

PureLogsStealer

252f901a3845e643dece809eb44c4e379814f002310560501592aee538503bd1

PureLogsStealer

2ee647ac7852be7cfbf2ab9b2b321292921ef9d0565715818adbcd7c0e9fbbb4

PureLogsStealer

3d72779314a937fb668feda17e3e527505c21b1e2d2fa0e731795c47d3f98fd6

PureLogsStealer

94d0084fb4121ce1d42f363b54ec8aac2caed34bcbbcf952b8c397cd4be32ecd

PureLogsStealer

ae05c7d70a5afa168435f9111cb79cdd6bfb1e17979b44de1540ccfd932a5b32

PureLogsStealer

cf1153dad2c1b9920dbe8104f86a915b2bff536cc8553993d21321f6470421d3

PureLogsStealer

d9745c3c74bdc3e3a192add8bae6a88bac3b6bfe8da02c4b0bc0df05d8a76870

PureLogsStealer

error

PureLogsStealer

+ 366 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/250925-kjnjdaep5x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5531a550-39b6-4ffa-813c-7299c0d4b41f

Unpacked files

SH256 hash:

f26b15aa89c33b3ceabfdbd1e2dbc1a1759587add95183baba90ca4d0607d6d2

MD5 hash:

7ae9d64c120cf88a5d8079ec2542ca93

SHA1 hash:

85e94cd8816fbf04766aeca538657e55d0ff812c

Link:

https://www.unpac.me/results/7306d6db-e4e3-4339-9a94-f5be72dc9116/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f26b15aa89c3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f26b15aa89c33b3ceabfdbd1e2dbc1a1759587add95183baba90ca4d0607d6d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETDLLMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)