home.social

#purelogs — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #purelogs, aggregated by home.social.

  1. UPDATE: Turns out the whole /wp-admin/js/ directory on Västkupan's website allows directory listing. Among the files in that directory is "New PO 102456688.exe", which drops #PureLogs.
    🔥 MD5: b2647b263c14226c62fe743dbff5c70a
    🔥 C2: 147.124.219.201:65535
    netresec.com/?b=257eead

  2. Do #PureLogs Stealer and #PureCrypter use the same C2 protocol, or is there some way to tell the C2 protocols apart?
    C2 servers:
    🔥 45.141.233.100:7708
    🔥 144.172.91.74:7709
    🔥 62.60.235.100:9100
    🔥 65.108.24.103:62050
    🔥 91.92.120.102:62050
    🔥 192.30.240.242:62520

  3. Two more #PureLogs Stealer DLL files found on vastkupan[.]com. The original blog post has been updated.
    netresec.com/?b=257eead

  4. PureLogs Forensics
    💧 Dropper connects to legitimate website
    📄 A fake PDF is downloaded over HTTPS
    💾 The fake PDF is decrypted to a #PureLogs DLL
    ⚙️ InstallUtil.exe or RegAsm.exe is started.
    💉 PureLogs DLL is injected into the running process
    👾 PureLogs connects to C2 server

    IOC List
    🔥 91.92.120.101:62520
    🔥 91.92.120.101:65535
    netresec.com/?b=257eead