Loading malware…
PureLogs is a Windows-targeting, .NET-based information stealer developed by PureCoder and marketed as malware-as-a-service since 2022. It is distinct from PureRAT, a separate remote access trojan from the same developer. PureLogs automates the collection and exfiltration of credentials, authentication tokens, and other sensitive information from compromised hosts.
The malware targets Chromium- and Firefox-family browsers for saved passwords, session cookies, browsing history, autofill records, and payment-card information. It also steals authentication data from messaging applications, email clients, file-transfer tools, VPN software, and password managers. Cryptocurrency targets include desktop wallets and browser extensions, from which it collects wallet data and private keys. Additional collection capabilities include screenshots, clipboard contents, hardware and operating-system details, installed security-product information, and selected files. Its modular architecture supports retrieving theft components from command-and-control infrastructure, and observed versions can download and execute additional payloads. Stolen data is transmitted through encrypted command-and-control communications.
PureLogs is distributed through business-themed phishing emails, malicious archive attachments, fraudulent document-sharing pages, ClickFix lures, fake software installers, and malicious developer extensions. Delivery chains frequently use PowerShell, layered loaders, reflective .NET loading, and process hollowing to execute payloads in memory. Observed deployments establish persistence through scheduled tasks, startup mechanisms, and registry autoruns. Obfuscation, commercial .NET protection, anti-debugging, and virtual-machine or sandbox checks hinder analysis; some samples avoid Russian-language systems.
PureLogs has been deployed by Fluffy Wolf against Russian organizations across construction, consulting, engineering, manufacturing, retail, and e-commerce. Other campaigns have targeted Japanese- and Korean-speaking business recipients and blockchain developers. Its commodity distribution enables use by multiple criminal operators rather than a single exclusive threat actor.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
After four stages of unpacking and injection, the PURELOGS stealer is now running inside the hollowed CasPol.exe process. PURELOGS is a commodity .NET infostealer that first appeared for sale on various underground forums in 2022.
These scripts systematically deploy the final payloads, which include the notorious Pay2Key ransomware, the PureLogs information stealer, and the PureRAT trojan.
Cyble Research and Intelligence Labs analyzes a spam campaign dropping PureLogs stealer aimed at Italian users... This tool is used by the Threat Actor (TA) “Alibaba2044” to launch a malicious spam campaign at targets based in Italy on the 14th of December 2022.
Cyble Research and Intelligence Labs analyzes a spam campaign dropping PureLogs stealer aimed at Italian users... This tool is used by the Threat Actor (TA) “Alibaba2044” to launch a malicious spam campaign at targets based in Italy on the 14th of December 2022.
68 distinct techniques documented for this family, organized by ATT&CK tactic.
The delivery chain begins at openclaw-installer.com, a convincing fake installer site... The site links to the GitHub organization openclaw-install/openclaw-installer ... which typosquats the legitimate OpenClaw project.
« Ce malware est généralement diffusé au moyen de [...] sites web compromis [...] »
Attacks that leverage malicious open-source packages are becoming a major and growing threat... We analyzed the code of every version of this extension and confirmed that it was a fake... All it does is download and execute malicious code from the aforementioned web server.
« Ce malware est généralement diffusé au moyen de campagnes de phishing, de liens malveillants [...] »
It's suspected that the initial payloads are distributed either via spear-phishing or a drive-by compromise.
商品の破損や返金依頼を装った日本語・韓国語の不審メールで、文書共有サイトや動画閲覧サイトを装うURLへ誘導した。
it builds a PowerShell command with a Base64-encoded payload and fires it off using WMI.
Type 2-1はタスクスケジューラーにWindowsFontCacheRestoreを作成し、FontCacheSync.vbsをwscript.exeで実行する。
If the victim extracts the archive, they find a script component called kpankocrs.js... Subsequently, the script launches an active PowerShell process with an execution policy bypass flag to run the code silently.
it builds a PowerShell command with a Base64-encoded payload and fires it off using WMI. It launches a hidden PowerShell process and runs the decoded payload in memory with Invoke-Expression.
The batch stagers are the initial execution layer. 29 .bat files recovered across six evidence directories deduplicate to 13 unique templates in four categories.
Further analysis revealed that the attackers used ScreenConnect to upload three VBScripts to the compromised machine: Each of these downloaded a PowerShell script from the text-sharing service paste.ee.
The ZIP contains a Python runtime and one or more loader scripts. Each loader decrypts embedded shellcode, and that shellcode bootstraps the .NET Common Language Runtime (CLR) to load the actual payload.
The infection chain begins with a deceptively named JavaScript file masquerading as a document (e.g., transcript.pdf.js), which executes through Windows Script Host.
allocate RWX memory, write shellcode via WriteProcessMemory ... ctypes.windll.kernel32.VirtualProtect(... 0x40, # PAGE_EXECUTE_READWRITE ... )
Specifically, the code targets the native utility MsBuild.exe located within the Microsoft .NET Framework folders.
“Once the target opens the batch file, the malware will start running on their machine… When the user clicks on this cab file, it will drop .NET-executable x.exe… and execute it.”
偽ページはZIPファイルのダウンロードを促し、ZIPファイル内のEXEファイルを実行すると最終的にPureRATまたはPureLogsに感染する。
After patching, Donut loads mscoree.dll , calls CLRCreateInstance to start the .NET CLR (v4.0.30319), and invokes ExecuteInDefaultAppDomain with the target class and method names stored in the instance.
Type 2-1はタスクスケジューラーにWindowsFontCacheRestoreを作成し、FontCacheSync.vbsをwscript.exeで実行する。
DLLはスタートアップフォルダーにショートカットを作成する。Type 2-1ではスタートアップのlnk/batとHKCU\Software\Microsoft\Windows\CurrentVersion\Runを用いる。
Type 2-1はタスクスケジューラーにWindowsFontCacheRestoreを作成し、FontCacheSync.vbsをwscript.exeで実行する。
запускает системную утилиту InstallUtil.exe и внедряет в ее процесс расшифрованный модуль... затем передать ей управление.
Injection technique: create a suspended notepad.exe , allocate RWX memory, write shellcode via WriteProcessMemory , queue an APC, resume the thread... Instead of notepad.exe, the loaders now create a suspended explorer.exe and use Early Bird APC injection
Type 3 Process Hollowing + BYOVD
DLLはスタートアップフォルダーにショートカットを作成する。Type 2-1ではスタートアップのlnk/batとHKCU\Software\Microsoft\Windows\CurrentVersion\Runを用いる。
UAC Bypass and Privilege Escalation ... The malware uses the Windows COM elevation moniker technique through the smethod_1() function.
At first glance, the file is unreadable: It's packed with non-ASCII characters that break static analysis and mess with signature-based detection.
DLLには処理に無関係なオーバーレイが存在し、ファイルサイズは75MBである。ファイルサイズ制限のあるセキュリティー製品やサンドボックスでの解析回避を意図していると考えられる。
The attackers embedded a Base64-encoded payload after the IEND chunk of the PNG... The actual malware sits between two custom markers, BaseStart- and -BaseEnd.
DLLの.rsrcセクションには175個のRCDATAリソースが格納され、シェルコードの断片と大量のダミーデータが含まれる。
No file hits disk, so basic file-based AV doesn't see it. Standard fileless execution.
A recent example uncovered by Labs involves a phishing campaign that uses environment variables to conceal malicious commands, employing PawsRunner as a steganography loader to deliver the PureLogs .NET infostealer.
« Ce malware est généralement diffusé au moyen de [...] faux logiciels [...] »
запускает системную утилиту InstallUtil.exe и внедряет в ее процесс расшифрованный модуль... затем передать ей управление.
Injection technique: create a suspended notepad.exe , allocate RWX memory, write shellcode via WriteProcessMemory , queue an APC, resume the thread... Instead of notepad.exe, the loaders now create a suspended explorer.exe and use Early Bird APC injection
Type 3 Process Hollowing + BYOVD
terminate selected processes such as "wscript.exe" to minimize forensic trail, delete "transcript.pdf.js" to eliminate evidence of execution
Self Deletion The malware implements a self-deletion mechanism to remove traces of its execution from the infected system.
Specifically, the code targets the native utility MsBuild.exe located within the Microsoft .NET Framework folders.
CHRDを起点として断片化データをシェルコードへ変換し、.NETローダーはPayloadSource.zipをTripleDES-CBCで復号してGZip展開する。
Type 3ではLenovo社の署名付きドライバーBootRepair.sysを同梱し、署名付きの脆弱なドライバーを悪用したBYOVDによるセキュリティー製品の停止を行う。
CasPol.exe is a legitimate .NET Framework tool (Code Access Security Policy Tool), which makes it the perfect cover. Security tools see it as a trusted Microsoft utility.
запускает системную утилиту InstallUtil.exe и внедряет в ее процесс расшифрованный модуль.
Sandbox Detection: Identifies and avoids known malware analysis environments
The malware scans for common debugging and network analysis tools to avoid running in monitored environments
AppVIsvSubsystems64.dllには隠し属性が設定されている。
After patching, Donut loads mscoree.dll , calls CLRCreateInstance to start the .NET CLR (v4.0.30319), and invokes ExecuteInDefaultAppDomain with the target class and method names stored in the instance.
Once extracted, the script Base64-decodes the payload and loads it directly into memory using .NET Reflection.
Multi-Stage Anti-Debugging: Detects and terminates when debuggers are present
Type 2-2はAMSI/ETW回避を使用し、Type 3は署名付きの脆弱なドライバーを悪用したBYOVDによりセキュリティー製品を停止する。
Core Capabilities Browser Credential Extraction: Steals saved passwords and session cookies from major browsers Application Token Harvesting: Targets Discord, Telegram, Steam, and FileZilla authentication data Cryptocurrency Wallet Theft: Extracts wallet information and private keys
Similarly, the malware interrogates specific system directories to capture authentication tokens from messaging applications. It targets multiple Discord releases to perform unauthorized account takeovers without requiring passwords.
« Il est conçu pour collecter et exfiltrer [...] les cookies de session [...] »
the malware compresses the entire extension data folder, which contains the encrypted seed phrases and private keys, into a ZIP archive.
Помимо стандартной функциональности по краже учетных данных и чувствительной информации из браузеров... PureLogs также похищает информацию из... менеджерам паролей
« Il est conçu pour collecter et exfiltrer [...] les identifiants enregistrés dans les navigateurs web, les cookies de session, les données de remplissage automatique, les informations bancaires [...] »
With these tools, the attackers successfully obtained passphrases for the developer’s wallets and then syphoned off cryptocurrency.
The malware prevents multiple instances of a program from running simultaneously using the Windows Registry as a lock mechanism. It first checks ... searches for a specific registry key under HKEY_CURRENT_USER\Software\
The collected data includes... Username.
The collected data includes... The current process full path.
PureRATは初回C2通信時にセキュリティー製品名、OSバージョン、アーキテクチャー、ユーザー名、ドメイン名、アイドル時間などを送信する。
“MITRE ATT&CK® Techniques… Discovery… T1083 File and Directory Discovery.”
Sandbox Detection: Identifies and avoids known malware analysis environments
The malware scans for common debugging and network analysis tools to avoid running in monitored environments
Multi-Stage Anti-Debugging: Detects and terminates when debuggers are present
« Il est conçu pour collecter et exfiltrer [...] différents fichiers susceptibles d’intéresser les attaquants. »
PureRATは初回通信時にスクリーンショットを送信し、PureLogsダウンローダーも/userinfoでシステム情報とスクリーンショットを送信する。
In addition, the spyware reads local clipboard balances...
“MITRE ATT&CK® Techniques… Collection… T1119 Automated Collection.”
The following is a list of harvested items: Web browsers... Extensions: (crypto wallets, password managers, and authenticators)... Wallet applications... Communication applications...
« Les informations dérobées sont regroupées avant d’être transmises à une infrastructure de commande et de contrôle contrôlée par les attaquants. »
Для общения с командным сервером PureRAT устанавливает SSL-соединения и передает сообщения в формате protobuf, упакованные в gzip.
PureLogsダウンローダーはGET /pingおよびPOST /plugin、/userinfo、/browser、/discord等のHTTPエンドポイントを用いて通信する。
В ответ от С2 приходит несколько сообщений, содержащих дополнительные модули (плагины) и конфигурацию к ним... способен выкачивать по переданному URL файл и запускать его.
PureRAT устанавливает SSL-соединения... В коммуникации PureLogs отсутствует установка SSL-соединения. Вместо этого передаваемые данные шифруются по алгоритму 3DES.
PureLogsダウンローダーは「16バイトIV || AES-256-CBC (GZip(data))」の形式で通信する。
“MITRE ATT&CK® Techniques… Exfiltration… T1020 Automated Exfiltration.”
« Les informations dérobées sont regroupées avant d’être transmises à une infrastructure de commande et de contrôle contrôlée par les attaquants. »
307 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
60 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.