Loading threat actor…
PureCoder is the developer identity associated with the commercial malware family PureLogs and a broader ecosystem of commoditized malicious tooling marketed to other threat actors. PureLogs is a .NET information stealer designed to collect browser-stored data, credentials, cookies, history, autofill data, application tokens, and cryptocurrency-wallet data. Reported associated offerings include PureCrypter, a .NET crypter used to protect and deliver payloads; PureMiner, a cryptocurrency miner; PureHVNC, a hidden VNC remote-access tool; and BlueLoader, a botnet framework advertised with persistence, bot management, DDoS, and bot-killing capabilities. This positions PureCoder primarily as a malware developer and seller supporting downstream criminal operations rather than as a single intrusion operator tied to one campaign. PureCoder-linked malware has been used in spam-delivered infections in which victims are lured into opening archived payloads that unpack a loader, decrypt an embedded payload in memory, and execute the final stealer through .NET reflection. PureLogs has been documented stealing credentials and tokens from browsers and applications including messaging, email, gaming, and VPN software, as well as collecting data from numerous cryptocurrency wallets. Observed behaviors associated with PureLogs and related tooling include initial access through user execution, defense evasion through obfuscation and in-memory loading, system and file discovery, automated local data collection, credential theft, crypto-theft, persistence in related tooling, DDoS capability in related tooling, and exfiltration over application-layer protocols. Known aliases directly supported at high confidence are limited to PureCoder.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
9 malware families Mallory has associated with this actor across public reporting.
4 additional families tracked in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.