⚠️ Overview

PureLogs Stealer is a commodity information-stealing malware first documented in early 2023 by researchers at Trend Micro, operating as a Malware-as-a-Service (MaaS) offered on Russian-language underground forums by a threat actor using the alias "PureLogs." It belongs to the infostealer category, specifically targeting credentials, cryptocurrency wallets, and browser data, and is known for its low price point and active development, with version 1.0 appearing in March 2023.

🔧 Technical Capabilities

PureLogs Stealer exfiltrates data from over 30 browsers (including Google Chrome, Mozilla Firefox, and Microsoft Edge), extracting saved passwords, cookies, autofill data, and credit card information. It targets cryptocurrency wallets such as Exodus, Electrum, and MetaMask by reading wallet files and keys, and also steals session tokens from applications like Telegram, Discord, and Steam. The malware propagates through phishing emails with malicious attachments (e.g., ISO or ZIP files) or via cracked software download sites, often using a loader like a .NET dropper. Its command-and-control (C2) infrastructure relies on HTTP POST requests to hardcoded IP addresses or domains, with data encrypted using AES-256 before exfiltration. Persistence is achieved by adding a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun, and evasion techniques include checking for sandbox environments (e.g., presence of analysis tools) and delaying execution to bypass dynamic analysis. PureLogs uses process hollowing to inject into legitimate processes like explorer.exe, as documented in a Cisco Talos report (August 2023).

📜 History & Notable Incidents

First identified in February 2023 by Trend Micro, PureLogs gained traction in April 2023 when a campaign targeted cryptocurrency users via fake browser update prompts, distributing the stealer through malvertising. No high-profile victims have been publicly named, but a September 2023 analysis by Zscaler ThreatLabz noted a surge in PureLogs variants incorporating keylogging and clipboard monitoring. No CVEs are associated with PureLogs itself, as it relies on social engineering rather than exploiting vulnerabilities. Law enforcement action has not been reported against the group as of early 2025.

🔍 Detection Indicators

File hashes for PureLogs samples are tracked by VirusTotal (e.g., SHA256 7c9d5e2a1f3b... etc.), but specific hashes change frequently due to polymorphism. Behavioral indicators include the creation of temporary files in %TEMP% with random names, outbound HTTP POSTs to obscure IPs (e.g., 185.141.26.103, per an open-source IOC list on Abuse.ch), and registry modifications under HKCU...RunPureLogsUpdate or similar keys. The malware uses a mutex named GlobalPureLogsMutex to prevent multiple instances, and its HTTP User-Agent string is often spoofed as Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36.

☠️ Risk & Impact

PureLogs Stealer causes data exfiltration of sensitive credentials and cryptocurrency assets, leading to identity theft, account takeover, and financial losses. Affected sectors include individual cryptocurrency investors and small businesses using weak password hygiene. The financial impact is mitigated by its low prevalence compared to larger stealers like RedLine, but a single successful infection can drain cryptocurrency wallets worth thousands of dollars, as reported by BleepingComputer in May 2023.

🛡️ Mitigation

Defenders should enforce multi-factor authentication (MFA) and restrict execution of scripts from untrusted sources, while deploying endpoint detection and response (EDR) rules that monitor for process hollowing and Run key modifications. YARA rules targeting PureLogs indicators (e.g., strings like "PureLogs" and "AES256" in memory) are available from the MITRE ATT&CK framework as part of technique T1555.003.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.