PureLogs StealerMalware
PureLogs, also known as PureLog Stealer, is an infostealer malware from the Pure family that aims to steal sensitive information from infected devices.From MISP Galaxy
Last reported 7 months ago, by Huntress2 reports
ATT&CK techniques
6 of 17 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027”
- T1027.009Embedded Payloads
“…ng and URL shortening service”, this stage is much larger than the previous Python script (40KB -> ~3 MB), as it contains two more embedded payloads.”
- T1053.005Scheduled Task
“Stealth Packer is a new packer that injects malware into memory, adds firewall rules, creates hidden ghost scheduled tasks, and performs potential AntiVM checks for mouse movement before running decrypted payloads.”
- T1055.012Process Hollowing
“T1055.012”
- T1056.001Keylogging
“These plugins could add functionality for anything from microphone/webcam access to real-time keylogging and hidden desktop access.”
- T1059.006Python
“T1059.006”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
How Fake OpenClaw Installers Spread GhostSocks Malware“This was most prominent within a binary called svc_service.exe suspected to be a Rust-based malware loader that runs PureLogs Stealer in memory.”
-
A Vietnamese threat actor's shift from PXA Stealer to PureRAT“PureLogs Stealer – an information stealer that exfiltrates browser data, saved credentials, and session tokens, often delivering them directly to the attacker’s Telegram.”
Indicators in its reports
named in the reports above- socifiapp[.]comin 1 report
- star-history[.]comin 1 report
- 249058ce8dc6e74c…5dceea008139in 1 report
- 0b6ed577b993fd81…184685af7e05in 1 report
- b73bd2e4cb16e903…896797435b82in 1 report
- 147.45.197[.]92in 1 report
- 94.228.161[.]88in 1 report
- e13d9304f7ebdab1…ecfebf18b9fdin 1 report
- 518ff5fbfa4296ab…5175fb70e2b3in 1 report
- f03e38e1c39ac521…f340523b4b51in 1 report
- 40fc240febf2441d…de38e266b378in 1 report
- 185.196.9[.]98in 1 report
- serverconect[.]ccin 1 report
- fd67063ffb0bcde4…1a0894f12690in 1 report
- d5dffba463beae20…d819a1809846in 1 report
- a22ddb3083b62dae…5c8908740ed5in 1 report
- 121.127.33[.]212in 1 report
- 144.31.123[.]157in 1 report
- 144.31.139[.]201in 1 report
- 144.31.139[.]203in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.