PureLogs

PureLogs is a Windows-focused .NET infostealer sold as a malware-as-a-service offering and associated with the Pure family of crimeware developed by PureCoder. Active since at least 2022, it is commonly deployed as a final-stage payload by loaders and crypters such as PureCrypter, Donut-based loaders, VMDetectLoader, and steganographic or fileless delivery chains. Observed campaigns have used phishing, archive-borne JavaScript or script launchers, fake software installers, ClickFix lures, and trojanized developer tooling or extensions to deliver the malware, including operations targeting enterprises, Russian organizations, and cryptocurrency users and developers.

Its primary function is theft and exfiltration of sensitive data from infected Windows hosts. PureLogs targets browser-stored credentials, cookies, session tokens, autofill data, payment-card data, Discord and other messaging-platform tokens, VPN credentials, email-client data, FTP client data, cryptocurrency wallet applications, and numerous browser extensions tied to wallets, password managers, and authenticators. Reported targeting includes Chromium- and Gecko-based browsers as well as applications such as Outlook, Thunderbird, Foxmail, Mailbird, FileZilla, WinSCP, Steam, Telegram, Signal, Discord, OpenVPN, and Proton VPN. Multiple reports also describe theft of host profiling data, screenshots, clipboard contents, antivirus information, and other system metadata.

PureLogs commonly uses staged, memory-resident execution and defense-evasion techniques. Observed tradecraft includes heavy obfuscation and commercial protectors such as .NET Reactor and IntelliLock, anti-debugging, anti-sandbox and anti-VM checks, mutex-based single-instance control, self-deletion, reflective .NET loading, and process injection or process hollowing into trusted Windows binaries such as MsBuild.exe, InstallUtil.exe, and CasPol.exe. Some variants decrypt embedded resources and configuration data with combinations of XOR, DES or TripleDES, AES, GZip, and Protobuf-serialized configuration blobs before retrieving additional modules or configuration from command-and-control infrastructure.

Beyond credential and data theft, PureLogs has documented downloader functionality and can fetch and execute additional payloads or collect files from specified locations for exfiltration. Communications with command-and-control servers have been described using custom binary protocols, Protobuf with compression, and encrypted transport including 3DES, AES, and in newer variants TLS or HTTPS. The malware has appeared in broader intrusion chains alongside other Pure-family malware such as PureRAT and with payloads including ransomware, underscoring its role both as a commodity stealer and as an enabler of follow-on compromise.