MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f897e71163801c9bb6ed48d15bb803ff1dcd186b87e752bb7d56c7fe55714225. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureHVNC

Vendor detections: 12

Intelligence 12 IOCs YARA 7 File information Comments

SHA256 hash:	f897e71163801c9bb6ed48d15bb803ff1dcd186b87e752bb7d56c7fe55714225
SHA3-384 hash:	9e2ade92ede0a59d3eea9c7a06070c1b61357f84f712a56a0be546fdb9d21732bd5166c0730bba773f17de88fd194d5f
SHA1 hash:	ead7b332c4615dd0f41251f609faec8e7ff0f3b1
MD5 hash:	e826a729e00d03690785f35c3fa815fe
humanhash:	yellow-texas-colorado-fruit
File name:	SecuriteInfo.com.Trojan.PWS.Siggen5.33555.20020.25604
Download:	download sample
Signature	PureHVNC Create hunting rule
File size:	576'512 bytes
First seen:	2026-06-08 16:24:58 UTC
Last seen:	2026-06-08 17:21:05 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'010 x Formbook, 12'352 x SnakeKeylogger)
ssdeep	12288:uekRgGOmqmOKbPmP4HqCdicpk565hn8b:DGOKbPG6u0n8
Threatray	47 similar samples on MalwareBazaar
TLSH	T1A7C4024A7B948766C18826BAC8D3492007F6FDDB6E73D30B7A6513A21D013E4CEC5B9D
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe PureHVNC

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NETReactor

Details

Link:

https://research.acce.ciphertechsolutions.com/results/9cdbae36-8a8e-4477-9256-7c0804c98bab/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/70093/

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a26ed233e9eff6a6b68d47f

Tags:

virus msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Creating a window

Connection attempt to an infection source

Sending a TCP request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

barys base64 net_reactor obfuscated obfuscated packed packed purehvnc

Link:

https://www.filescan.io/uploads/6a26ed221f652d68656fec4d/reports/4f18d238-8201-4656-b3c1-56bfd00aaa32/overview

Verdict:

Malicious

Labled as:

Barys.Generic

Link:

https://www.hybrid-analysis.com/sample/f897e71163801c9bb6ed48d15bb803ff1dcd186b87e752bb7d56c7fe55714225

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-05-22T06:52:00Z UTC

Last seen:

2026-05-28T19:09:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/f897e71163801c9bb6ed48d15bb803ff1dcd186b87e752bb7d56c7fe55714225/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/cff3672a-0659-4e8e-80c1-e70719346cf7

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f897e71163801c9bb6ed48d15bb803ff1dcd186b87e752bb7d56c7fe55714225

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f897e71163801c9bb6ed48d15bb803ff1dcd186b87e752bb7d56c7fe55714225/

Threat name:

ByteCode-MSIL.Trojan.Barys

Status:

Malicious

First seen:

2026-05-21 15:16:32 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

28 of 36 (77.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7cl6oeldqaojxnxnjdivxoad74o42gdlq7tvfo35k3d74vlriisq._file

Verdict:

malicious

Label(s):

purecrypter

PureHVNC

4334b32b02f055ad7553e21cf13b1706b892a648fadb4584cafb3283245f6389

PureHVNC

8918151f86687bf6dcd6962b05fe94d4a48c400d89cfdee172d8ee70f06c3403

PureHVNC

b6a4ce1b28a8c0754b1ce5d4832644ca3c0e4571556e9c5bfe3ae9da97589366

PureHVNC

b95012a5ed4784b632680ca3291db8dd17908c5137279e190a06563cd111665f

PureHVNC

d4e2fc9946830fa27ea397c7dab7ffc56501f7b75df4deede18bc2708fa23f1b

PureHVNC

error

PureHVNC

f272a51c813b2d3c3748457bd842ae2125596dc6786e1a326bac2479b01273cf

PureHVNC

f897e71163801c9bb6ed48d15bb803ff1dcd186b87e752bb7d56c7fe55714225

PureHVNC

+ 37 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

collection discovery spyware stealer

Link:

https://tria.ge/reports/260608-txde1acz3l/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Accesses Microsoft Outlook profiles

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

f897e71163801c9bb6ed48d15bb803ff1dcd186b87e752bb7d56c7fe55714225

MD5 hash:

e826a729e00d03690785f35c3fa815fe

SHA1 hash:

ead7b332c4615dd0f41251f609faec8e7ff0f3b1

Link:

https://www.unpac.me/results/edd2e5e3-4525-40fb-9e2c-8a1265dca351/

SH256 hash:

4b219392bf69b9d98be3c8f3ea112bbefa4b0bcc5a2aa85c1988a314c5583766

MD5 hash:

930955ddce4ba86df1af951ac726c2f1

SHA1 hash:

6dcfa56bf3dbcfc478ea58e6d19f5eb6b596f2fc

Link:

https://www.unpac.me/results/edd2e5e3-4525-40fb-9e2c-8a1265dca351/

SH256 hash:

fbade948d89f02da39affa6b7a4620faf8d5d52e5ad8861f58151f151485caef

MD5 hash:

5aa4e72314c435aad2915386b6b5c243

SHA1 hash:

8ddfa3a1cee6c38bcfc5ee084dfcf02d80248f86

Link:

https://www.unpac.me/results/edd2e5e3-4525-40fb-9e2c-8a1265dca351/

SH256 hash:

b2a66e9864f81c2800a5afef4bfd1faf7c910e5a43ea2eb9dbb15c8ab6ffc633

MD5 hash:

f0a13fb422cdb1f3ce667df897b5045b

SHA1 hash:

9b6566603e3a292482788924a83a1d94a9cd4627

Link:

https://www.unpac.me/results/edd2e5e3-4525-40fb-9e2c-8a1265dca351/

Malware family:

PureHVNC

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f897e7116380/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.