MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc6a7e49e66a4878755d3ef0c95236e3443c8a2bfe10a634d03660f543c3a038. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureLogsStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc6a7e49e66a4878755d3ef0c95236e3443c8a2bfe10a634d03660f543c3a038
SHA3-384 hash: 04370526873d5e256e1f38c4c0a1070d85f405c7ff29f2daa290166d22b2a53524932ab82265d373eb84641b466e083d
SHA1 hash: 546431ea87ed5d55a437b5d1732a0b110ce6ade5
MD5 hash: 6359a5acabcdabe63e38bc1c47f32690
humanhash: butter-oscar-orange-johnny
File name:57008369310.pdf
Download: download sample
Signature PureLogsStealer
Create hunting rule
File size:1'612'800 bytes
First seen:2026-07-16 06:42:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'121 x AgentTesla, 20'132 x Formbook, 12'360 x SnakeKeylogger)
ssdeep 49152:mwIkI+gC8wdFqu0vXJdBZGXuMH5e2pXK:mPkdrbqzvXzBIXv
Threatray 71 similar samples on MalwareBazaar
TLSH T19E752399524BE603CA4913324EE1F67423B94ED96053C25B7FEC3EAFBD32B555E04282
TrID 72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.4% (.EXE) Win64 Executable (generic) (6522/11/2)
4.4% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter abuse_ch
Tags:exe pdf PureLogsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
NETReactor RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/cbb17c29-2d00-46c6-a29c-707bc01f5aed/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74864/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.34842572.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a587d9c56bd89099b556c65
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade net_reactor obfuscated packed packed
Link:
https://www.filescan.io/uploads/6a587d977190d6a3ddbd989b/reports/cdaf768a-e3e6-4c75-ab64-4fc8e24ec100/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/fc6a7e49e66a4878755d3ef0c95236e3443c8a2bfe10a634d03660f543c3a038
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-15T08:43:00Z UTC
Last seen:
2026-07-18T02:58:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/fc6a7e49e66a4878755d3ef0c95236e3443c8a2bfe10a634d03660f543c3a038/results?tab=lookup
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9f1a5440-cd91-4279-84e1-84fb9938d37d
Result
Threat name:
PureLogs Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1943311
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected MSIL Injector
Yara detected PureLogs Stealer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1943311 Sample: 57008369310.pdf.exe Startdate: 16/07/2026 Architecture: WINDOWS Score: 100 56 Antivirus / Scanner detection for submitted sample 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 Yara detected PureLogs Stealer 2->60 62 8 other signatures 2->62 8 57008369310.pdf.exe 3 2->8         started        12 57008369310.pdf.exe 2 2->12         started        process3 file4 38 C:\Users\user\...\57008369310.pdf.exe.log, ASCII 8->38 dropped 64 Found many strings related to Crypto-Wallets (likely being stolen) 8->64 66 Injects a PE file into a foreign processes 8->66 68 Switches to a custom stack to bypass stack traces 8->68 70 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 8->70 14 57008369310.pdf.exe 15 5 8->14         started        18 57008369310.pdf.exe 4 12->18         started        20 57008369310.pdf.exe 12->20         started        22 57008369310.pdf.exe 12->22         started        24 57008369310.pdf.exe 12->24         started        signatures5 process6 dnsIp7 54 64.89.160.76, 49734, 49735, 49736 GHOSTYNETWORKSUS Luxembourg 14->54 72 Tries to steal Mail credentials (via file / registry access) 14->72 74 Found many strings related to Crypto-Wallets (likely being stolen) 14->74 76 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->76 84 2 other signatures 14->84 26 chrome.exe 1 14->26         started        29 chrome.exe 2 14->29 injected 78 Tries to harvest and steal browser information (history, passwords, etc) 18->78 80 Writes to foreign memory regions 18->80 82 Tries to harvest and steal Bitcoin Wallet information 18->82 31 chrome.exe 18->31         started        signatures8 process9 dnsIp10 52 192.168.2.7, 443, 49199, 49606 unknown unknown 26->52 33 chrome.exe 26->33         started        36 chrome.exe 31->36         started        process11 dnsIp12 40 googlehosted.l.googleusercontent.com 142.251.111.132, 443, 49752 GOOGLE-GoogleLLCUS United States 33->40 42 www.google.com 142.251.151.119, 443, 49743, 49746 GOOGLE-GoogleLLCUS United States 33->42 50 5 other IPs or domains 33->50 44 142.251.156.119, 443, 49775, 49776 GOOGLE-GoogleLLCUS United States 36->44 46 172.253.63.132, 443, 49787, 49788 GOOGLE-GoogleLLCUS United States 36->46 48 clients2.googleusercontent.com 36->48
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fc6a7e49e66a4878755d3ef0c95236e3443c8a2bfe10a634d03660f543c3a038
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.70 Win 32 Exe x86
Link:
https://app.malva.re/file/6359a5acabcdabe63e38bc1c47f32690
Detection:
purelogs
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fc6a7e49e66a4878755d3ef0c95236e3443c8a2bfe10a634d03660f543c3a038/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2026-07-16 01:07:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7rvh4spgnjehq5k5h3ymsurw4ncdzcrl7yikmngqgzqpkq6dua4a._file
Verdict:
malicious
Label(s):
purecrypter
Create hunting rule
xworm
Create hunting rule
Similar samples:
1d90e2132fbbb2656689c6de7d8926cb61763a5c746fc6f4bfef9f49b91b3bab
PureLogsStealer
22929fd615674a4e46fa8d2f845b19675d0328c687a136cd847a1f2411dd84d4
PureLogsStealer
38d8dbf64062747f22fd847354d4f74282946532899a3def1006004675a55d65
PureLogsStealer
8b18c11fe95bd59dd8e018d75668792c478e557a71a54a7f078f2ef4f060ab0c
PureLogsStealer
ba8fac34067f7e21e6fad69fbbd002e80cacda21fa07a8e82a5063bfda3ecc82
PureLogsStealer
dc6790cdf758ba93696edf19d490d1fbb59a4312d456c77a498ccf3b955e1572
PureLogsStealer
error
PureLogsStealer
fc6a7e49e66a4878755d3ef0c95236e3443c8a2bfe10a634d03660f543c3a038
PureLogsStealer
+ 61 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection discovery spyware stealer
Link:
https://tria.ge/reports/260716-hg7s5aat8x/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Drops startup file
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
fc6a7e49e66a4878755d3ef0c95236e3443c8a2bfe10a634d03660f543c3a038
MD5 hash:
6359a5acabcdabe63e38bc1c47f32690
SHA1 hash:
546431ea87ed5d55a437b5d1732a0b110ce6ade5
Link:
https://www.unpac.me/results/cac4217a-67d6-453b-9a43-fd6a908f0bee/
SH256 hash:
23e29d40aac52b1dc1ab2b219c91323d4ca900deac263d29f9b8792eb182b25f
MD5 hash:
6cc30976cc7db0c7d478af6669977738
SHA1 hash:
44099bfbc543ce9c3e8ff9e5e50a3760b25b12c3
Link:
https://www.unpac.me/results/cac4217a-67d6-453b-9a43-fd6a908f0bee/
SH256 hash:
d033ca6f6fc6f56933921422663e7b4612ad0a9893fb58251851ccd743488ebf
MD5 hash:
e5596f079615003f522014b654e483d2
SHA1 hash:
83ff6339a634c88e887e09db7b27f1d6aed9bcc3
Link:
https://www.unpac.me/results/cac4217a-67d6-453b-9a43-fd6a908f0bee/
SH256 hash:
dd4ddcb93d369da8437b8f8f1386fec6a5b18251c94e0911c38540bb9a9fa280
MD5 hash:
d5a49cd6b89e6063ba408f9bfceae073
SHA1 hash:
e27b970a099864abf9190a5b26894ffb1e58e271
Link:
https://www.unpac.me/results/cac4217a-67d6-453b-9a43-fd6a908f0bee/
SH256 hash:
a22db6ddccb087305d3e91cebc45c844a087d725ac1649fb1a0f6983818790f5
MD5 hash:
20149ba9f971fb1da901e8cc4558775a
SHA1 hash:
1044a8da4b6eeda19a0007ae63b6188eafefb6c3
Link:
https://www.unpac.me/results/cac4217a-67d6-453b-9a43-fd6a908f0bee/
SH256 hash:
d6447f1c4c4387583f25b4b74888d77127cb19e705445f0ffebf8c3c38682074
MD5 hash:
040e0f79f2544d8ec1bc66cdddc662d2
SHA1 hash:
1d6cea3e210698bcb8f180a6224f983af32fcfac
Link:
https://www.unpac.me/results/cac4217a-67d6-453b-9a43-fd6a908f0bee/
SH256 hash:
8798a72056eaae576a5b6efea7cd5ee26d88c5ae2dfe9d8acda1dea9dcac9a61
MD5 hash:
ae5f749e99e51f7c23b8b6251f4a59f8
SHA1 hash:
cc7cbaa2ce659ea15cb550f3087d37c81291f248
Link:
https://www.unpac.me/results/cac4217a-67d6-453b-9a43-fd6a908f0bee/
Malware family:
PureRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fc6a7e49e66a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc6a7e49e66a4878755d3ef0c95236e3443c8a2bfe10a634d03660f543c3a038

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/74864/

Comments