Loading malware…
PureLogs Stealer is an information-stealing malware family focused on harvesting saved data from browsers, messaging applications, cryptocurrency wallets, and other applications. Reporting in the provided content describes it as a credential harvester and places it within broader crimeware toolchains alongside PureHVNC, PureCrypter, PureRAT, ResolverRAT, STXRAT, and likely Lumma/ZgRAT. It has been associated with malware developed by PureCoder and was also referenced in campaigns attributed to financially motivated operators, including activity linked to VasyGrek/Fluffy Wolf and phishing campaigns tracked by Cofense.
Observed delivery and execution methods include phishing, trojanized software installers, in-memory loaders, and multi-stage PowerShell/.NET chains. One analyzed sample, also referred to as PXRECVOWEIWOEI, was a .NET malware sample without a packer or crypter that used obfuscated unused long-string variables to hinder analysis. A key variable contained a Base64-encoded PowerShell script that downloaded DetahNoteJ.txt, Base64-decoded it into a .NET assembly/DLL, and executed it via PowerShell. Related hashes from that analysis were 574403DCE45BE3A5EDEC18E66F16FEF5E013CE99C7713479AB67C11E6F472330 (main sample), 16912B71BDEFBB0B9E0B0E71D85B0095880D4DC250239E7D26E12454F7F6BADF (DetahNoteJ.txt), and 97164081607B6FDB9B095CB01BB0A818FC77DB92DAD38B910B05A90160748756 (decoded DLL).
In an intrusion observed on 2026-04-10, PureLogs Stealer was injected into calc.exe after initial compromise via a trojanized CPU-Z archive that side-loaded a malicious CRYPTBASE.dll to launch STXRAT. During that intrusion, PureLogs communicated with 176.65.144[.]84:8443, generated Suricata detections for zgRAT / PureLogs Stealer C2 ping traffic and a PureLogs plugin request, and launched headless Chrome and Microsoft Edge with --no-sandbox to harvest saved credentials. The same operation later deployed PureHVNC and used rclone plus a QEMU Alpine VM for prolonged exfiltration.
Additional reporting describes a Rust-based loader, svc_service.exe, suspected of running PureLogs Stealer in memory in a fake OpenClaw installer campaign. More broadly, Breakglass Intelligence linked PureLogs Stealer to a large cybercrime ecosystem active since at least November 2025 that used ClearFake/ClickFix fake browser update lures, Donut in-memory loading, obfuscated .NET payloads, encrypted HTTPS communications, fallback ports including 8443, and certificate pinning across a shared C2 infrastructure spanning multiple domains, IPs, hosting providers, and countries.
High-confidence indicators mentioned in the content include C2 endpoint 176.65.144[.]84:8443, the filename DetahNoteJ.txt, and the hashes 574403DCE45BE3A5EDEC18E66F16FEF5E013CE99C7713479AB67C11E6F472330, 16912B71BDEFBB0B9E0B0E71D85B0095880D4DC250239E7D26E12454F7F6BADF, and 97164081607B6FDB9B095CB01BB0A818FC77DB92DAD38B910B05A90160748756.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Stealth Packer is a new packer that... creates hidden ghost scheduled tasks... EdgeUpdateHelper Scheduled Task ... Set to run ... AdobeCloudHelper.exe daily
The decoded base64 is a powershell script... The powershell script downloads the DetahNoteJ.txt ... Finally, the output is executed via a powershell.
The sample opened in notepad++ looks full of long strings assigned to variables with extremely long names. The variables seem to be added purposely to distract us from the actual investigation point.
This blog details an investigation into malicious GitHub repositories posing as OpenClaw installers... At first glance, the GitHub repository could easily be mistaken for a legitimate installer.
2026-04-10 10:08:25 > PureLogs Stealer injected into calc.exe; C2: 176.65.144[.]84:8443
Command and Control Fallback Channels T1008 22 C2 IPs, 8 domains, 10+ port options
CRYPTBASE.dll side-loaded by CPU-Z binary; STXRAT dropper executes; C2 beacon to welcome.supp0v3[.]com
54 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
PureLogs Stealer is used for credential theft. It injects into calc.exe and launches headless Chrome and Edge instances with no-sandbox flags to harvest saved browser credentials, using legitimate browser binaries to evade some detections.
Credential-stealing malware that harvests data from browsers, wallets, and applications. It is deployed alongside RAT and HVNC components in the same campaign.
PureLogs Stealer is an information stealer. Here it was suspected to be executed in memory by a Rust-based loader packed with Stealth Packer and connected back to attacker infrastructure.
Information stealer malware used to exfiltrate credentials and sensitive data from infected systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.