MALICIOUS — 3efec8bc14ce292b63dada6c63b890a4c9d1598e4534dcee069ad3136ff82375.exe

MALICIOUS — 3efec8bc14ce292b63dada6c63b890a4c9d1598e4534dcee069ad3136ff82375.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PureLogStealer family. 8 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 3efec8bc14ce292b63dada6c63b890a4c9d1598e4534dcee069ad3136ff82375
SHA-1: 7d20a39ccf699d20e2db54aaf6d712ae05af6020
MD5: d62739dd92c54d194150ef0638c01895
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 24576:ZP37p50fyqzCOpJBueRgPDvTI9/jo0XORV2aMW8tSUzUtr15:ZTps3zCOpGvPDcGRh/8w
TLSH: T1B254129E316C8D41DCEE52B53A439EECD9A007A658D86ACDC729784102DEF73103D8B6
Submitted as: 3efec8bc14ce292b63dada6c63b890a4c9d1598e4534dcee069ad3136ff82375.exe
File type: pe · Size: 1111552 bytes
Verdict: malicious (100/100) · Family: PureLogStealer

Source: MalwareBazaar · first seen 2026-07-27T00:00:00.000Z · SHA-256 verified

Detections (8 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.Malwarex-10060428-0
YARA: Trellix/McAfee ATR: ATR_LockBit_Ransomware
Hash: abuse.ch ThreatFox: known-malicious-hash
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:MSIL/PureLogStealer.ABPC!MTB
Emsisoft (Emergency Kit): Trojan.GenericKD.80929704
Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Packed.Malwarex-10060428-0 (rule Win.Packed.Malwarex-10060428-0) - engine signal, weight 0.90, confidence 0.95
Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:MSIL/PureLogStealer.ABPC!MTB (rule Trojan:MSIL/PureLogStealer.ABPC!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80929704 (rule Trojan.GenericKD.80929704) - engine signal, weight 0.55, confidence 0.85
Extracted Formbook config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: Trellix/McAfee ATR flagged ATR_LockBit_Ransomware (rule ATR_LockBit_Ransomware) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://tempuri.org/SoapBubbleStats.xsd - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

4759 behavior events · 1 ATT&CK techniques · 11 dropped files.

Dropped files

e4e98c56847f65b0ec79dd0fcd73f780be8e5b64a78def50b3d447c6a22aab6d - e4e98c56847f65b0ec79dd0fcd73f780be8e5b64a78def50b3d447c6a22aab6d
0258b9914b0d97c2731657fdacb88c646d54f5da3231ce1f05c7649b6c74f92d - 0258b9914b0d97c2731657fdacb88c646d54f5da3231ce1f05c7649b6c74f92d
7cbbcae532de28c4ebc72d2134da80468ef4386880b6f93f37ad50fdb70d2904 - 7cbbcae532de28c4ebc72d2134da80468ef4386880b6f93f37ad50fdb70d2904
99c70b99b81728d34c92934231b9c4706715df2cfa2b2e407d2c1ab393f369e6 - 99c70b99b81728d34c92934231b9c4706715df2cfa2b2e407d2c1ab393f369e6
2d74ce1234cfda8c6e00bc66fe6849591bb2141148aba9e8b40af9cf9e730a2b - 2d74ce1234cfda8c6e00bc66fe6849591bb2141148aba9e8b40af9cf9e730a2b
9169bd8f32cd21800b7b8017ca58f476e2d7acfb3e7f9c056c7a2d84afe5d815 - 9169bd8f32cd21800b7b8017ca58f476e2d7acfb3e7f9c056c7a2d84afe5d815
7805efce9ba598c3177effa68832364642301872ab861793e9de5c83fbc82de7 - 7805efce9ba598c3177effa68832364642301872ab861793e9de5c83fbc82de7
aa22a4679a515ea7b72bb03559f3aa8c22fc519e89aa5249de30b917d09eb263 - aa22a4679a515ea7b72bb03559f3aa8c22fc519e89aa5249de30b917d09eb263
95dadf0b3ef2cf36559421c44a5fd5222f288ed5d8afedd4e18ac3bfdc7a6f6e - 95dadf0b3ef2cf36559421c44a5fd5222f288ed5d8afedd4e18ac3bfdc7a6f6e
634faba27ac7048ed335501905c30af0ceb11b6b78ac26e8c894bd96d6bc600b - 634faba27ac7048ed335501905c30af0ceb11b6b78ac26e8c894bd96d6bc600b
38ac49993f49928554a27291262019f908ab7231b9b83fe617d22cc7a9cc7273 - 38ac49993f49928554a27291262019f908ab7231b9b83fe617d22cc7a9cc7273

Embedded URLs

http://tempuri.org/SoapBubbleStats.xsd

Embedded domains

tx.io
y.br
tempuri.org

File paths

y:\$

More PureLogStealer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report