#purelogs — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #purelogs, aggregated by home.social.
-
UPDATE: Turns out the whole /wp-admin/js/ directory on Västkupan's website allows directory listing. Among the files in that directory is "New PO 102456688.exe", which drops #PureLogs.
🔥 MD5: b2647b263c14226c62fe743dbff5c70a
🔥 C2: 147.124.219.201:65535
https://netresec.com/?b=257eead -
Do #PureLogs Stealer and #PureCrypter use the same C2 protocol, or is there some way to tell the C2 protocols apart?
C2 servers:
🔥 45.141.233.100:7708
🔥 144.172.91.74:7709
🔥 62.60.235.100:9100
🔥 65.108.24.103:62050
🔥 91.92.120.102:62050
🔥 192.30.240.242:62520 -
Two more #PureLogs Stealer DLL files found on vastkupan[.]com. The original blog post has been updated.
https://netresec.com/?b=257eead -
PureLogs Forensics
💧 Dropper connects to legitimate website
📄 A fake PDF is downloaded over HTTPS
💾 The fake PDF is decrypted to a #PureLogs DLL
⚙️ InstallUtil.exe or RegAsm.exe is started.
💉 PureLogs DLL is injected into the running process
👾 PureLogs connects to C2 serverIOC List
🔥 91.92.120.101:62520
🔥 91.92.120.101:65535
https://netresec.com/?b=257eead -
Video: Detecting #PureLogs traffic with #CapLoader
https://netresec.com/?b=256a8c4 -
Some fresh #pureloader + #purelogs #stealer
https://app.any.run/tasks/b7141b83-ab60-4072-b208-f6cbdeb224f2
c2: 91.92.253.88