#purelogs β Public Fediverse posts
Live and recent posts from across the Fediverse tagged #purelogs, aggregated by home.social.
-
@james_inthe_box Thank you for sharing! The #PureLogs C2 server seems to be on 2.27.62.123:4449
Turns out JoeSandbox has history for that C2 server since at least 2026-04-08.
https://www.joesandbox.com/analysis/search?ioc-public-ip=2.27.62.123 -
Handful of IOC's for those .js #purelogs #stealer #malspams:
https://app.any.run/tasks/43e561e4-707a-4189-8b4c-d4795b2451a6
Exfil port is 4449
Calls hidden Edge
Calls hidden Chrome -
zgRAT is a confusing catch-all label: both #PureLogs and #PureRAT commonly trigger "zgRAT" detections. Please don't label malware as #zgRAT.
https://netresec.com/?b=267e877 -
π’π¨π£ Fake purchase order emails are spreading fileless #PureLogs malware through malicious RAR archives, targeting Windows users and stealing browser credentials, crypto wallet data, VPN logins, Discord tokens, and more.
Read: https://hackread.com/purchase-emails-fileless-purelogs-malware-rar-archives/
-
UPDATE: Turns out the whole /wp-admin/js/ directory on VΓ€stkupan's website allows directory listing. Among the files in that directory is "New PO 102456688.exe", which drops #PureLogs.
π₯ MD5: b2647b263c14226c62fe743dbff5c70a
π₯ C2: 147.124.219.201:65535
https://netresec.com/?b=257eead -
Do #PureLogs Stealer and #PureCrypter use the same C2 protocol, or is there some way to tell the C2 protocols apart?
C2 servers:
π₯ 45.141.233.100:7708
π₯ 144.172.91.74:7709
π₯ 62.60.235.100:9100
π₯ 65.108.24.103:62050
π₯ 91.92.120.102:62050
π₯ 192.30.240.242:62520 -
Two more #PureLogs Stealer DLL files found on vastkupan[.]com. The original blog post has been updated.
https://netresec.com/?b=257eead -
PureLogs Forensics
π§ Dropper connects to legitimate website
π A fake PDF is downloaded over HTTPS
πΎ The fake PDF is decrypted to a #PureLogs DLL
βοΈ InstallUtil.exe or RegAsm.exe is started.
π PureLogs DLL is injected into the running process
πΎ PureLogs connects to C2 serverIOC List
π₯ 91.92.120.101:62520
π₯ 91.92.120.101:65535
https://netresec.com/?b=257eead -
Video: Detecting #PureLogs traffic with #CapLoader
https://netresec.com/?b=256a8c4 -
Some fresh #pureloader + #purelogs #stealer
https://app.any.run/tasks/b7141b83-ab60-4072-b208-f6cbdeb224f2
c2: 91.92.253.88