MalwareUsed by 1 actor

VMDetectLoader

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

hive0131

The .NET assembly loaded by the PowerShell stager is what IBM X-Force researchers call 'VMDetectLoader'. This modular loader is responsible for persistence options, environment checks, and injecting the next stage.

via swisspost cybersecurity newsswisspost-cybersecurity.ch

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.001PowerShellEvidence1

it builds a PowerShell command with a Base64-encoded payload and fires it off using WMI. It launches a hidden PowerShell process and runs the decoded payload in memory with Invoke-Expression.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

the loader employs a classic, well-documented process injection technique known as RunPE , or process hollowing

T1055.012Process HollowingEvidence1

It launches the legitimate .NET Framework utility CasPol.exe in a suspended state, removes its original code from memory, and replaces it with the decoded payload.

Stealth

8 techniques

T1027Obfuscated Files or InformationEvidence1

At first glance, the file is unreadable: It's packed with non-ASCII characters that break static analysis and mess with signature-based detection.

T1027.011Fileless StorageEvidence1

No file hits disk, so basic file-based AV doesn't see it. Standard fileless execution.

T1055Process InjectionEvidence1

the loader employs a classic, well-documented process injection technique known as RunPE , or process hollowing

T1055.012Process HollowingEvidence1

It launches the legitimate .NET Framework utility CasPol.exe in a suspended state, removes its original code from memory, and replaces it with the decoded payload.

T1140Deobfuscate/Decode Files or InformationEvidence1

its sole purpose is to decrypt, decompress, and execute the final payload entirely within memory.

T1218System Binary Proxy ExecutionEvidence1

CasPol.exe is a legitimate .NET Framework tool (Code Access Security Policy Tool), which makes it the perfect cover. Security tools see it as a trusted Microsoft utility.

T1497Virtualization/Sandbox EvasionEvidence1

VM Detection Enabled : A standard sandbox evasion check. If the loader detects that it's running in a virtual machine, it terminates.

T1620Reflective Code LoadingEvidence1

Once extracted, the script Base64-decodes the payload and loads it directly into memory using .NET Reflection.

Discovery

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

VM Detection Enabled : A standard sandbox evasion check. If the loader detects that it's running in a virtual machine, it terminates.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Instead of fetching an executable from some disposable domain, it downloads a PNG image from archive.org... The loader's main job is to fetch the next stage payload.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 months ago

hash.sha256●●●●●●●●●●●●View more in app6 months ago

uri●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

swisspost cybersecurity newsNews

Jan 19, 2026

Don't Judge a PNG by Its Header: PURELOGS Infostealer Analysis

Modular .NET loader used in this campaign to perform VM detection, optional persistence, retrieve the next payload, and inject it into CasPol.exe via RunPE/process hollowing.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

VMDetectLoader

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

hive0131

via swisspost cybersecurity newsswisspost-cybersecurity.ch

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.001PowerShellEvidence1

it builds a PowerShell command with a Base64-encoded payload and fires it off using WMI. It launches a hidden PowerShell process and runs the decoded payload in memory with Invoke-Expression.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

the loader employs a classic, well-documented process injection technique known as RunPE , or process hollowing

T1055.012Process HollowingEvidence1

It launches the legitimate .NET Framework utility CasPol.exe in a suspended state, removes its original code from memory, and replaces it with the decoded payload.

Stealth

8 techniques

T1027Obfuscated Files or InformationEvidence1

At first glance, the file is unreadable: It's packed with non-ASCII characters that break static analysis and mess with signature-based detection.

T1027.011Fileless StorageEvidence1

No file hits disk, so basic file-based AV doesn't see it. Standard fileless execution.

T1055Process InjectionEvidence1

the loader employs a classic, well-documented process injection technique known as RunPE , or process hollowing

T1055.012Process HollowingEvidence1

It launches the legitimate .NET Framework utility CasPol.exe in a suspended state, removes its original code from memory, and replaces it with the decoded payload.

T1140Deobfuscate/Decode Files or InformationEvidence1

its sole purpose is to decrypt, decompress, and execute the final payload entirely within memory.

T1218System Binary Proxy ExecutionEvidence1

CasPol.exe is a legitimate .NET Framework tool (Code Access Security Policy Tool), which makes it the perfect cover. Security tools see it as a trusted Microsoft utility.

T1497Virtualization/Sandbox EvasionEvidence1

VM Detection Enabled : A standard sandbox evasion check. If the loader detects that it's running in a virtual machine, it terminates.

T1620Reflective Code LoadingEvidence1

Once extracted, the script Base64-decodes the payload and loads it directly into memory using .NET Reflection.

Discovery

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

VM Detection Enabled : A standard sandbox evasion check. If the loader detects that it's running in a virtual machine, it terminates.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Instead of fetching an executable from some disposable domain, it downloads a PNG image from archive.org... The loader's main job is to fetch the next stage payload.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 months ago

hash.sha256●●●●●●●●●●●●View more in app6 months ago

uri●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

swisspost cybersecurity newsNews

Jan 19, 2026

Don't Judge a PNG by Its Header: PURELOGS Infostealer Analysis

Modular .NET loader used in this campaign to perform VM detection, optional persistence, retrieve the next payload, and inject it into CasPol.exe via RunPE/process hollowing.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.