PureLog Stealer Multi-Stage Fileless Campaign Using Copyright Infringement Lures
PureLog Stealer Multi-Stage Fileless Campaign Using (TL-2026-0252), also tracked as PureLogs Stealer Campaign, is a high-severity malware campaign, first published 2026-03-20. It is attributed to PureCoder (Russia) with low confidence, affects Multiple Windows Endpoints, maps to 24 MITRE ATT&CK techniques (T1005, T1010, T1012), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-0252
- Threat ID
- TL-2026-0252
- Also known as
- PureLogs Stealer Campaign, Copyright Lure PureLog Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-03-20
- Last reviewed
- 2026-03-20
- Attribution
- PureCoder
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- healthcare, government, hospitality, education
- Target regions
- Germany, Canada, United States, Australia
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in PureLog Stealer Multi-Stage Fileless Campaign Using
Malware and tooling: PureLogs, ConfuserEx
An active multi-stage attack campaign delivers PureLog Stealer entirely in memory using encrypted, fileless techniques. The campaign uses language-matched copyright infringement lures to target healthcare, government, hospitality, and education sectors across Germany, Canada, the United States, and Australia, featuring AMSI bypass, XOR and TripleDES-CBC encryption, dual .NET loader chains, and remote decryption key retrieval.
How PureLog Stealer Multi-Stage Fileless Campaign Using works
PureLog Stealer is a commodity .NET infostealer from the PureCoder malware-as-a-service (MaaS) ecosystem, sold on underground forums for as little as $99/month. This campaign represents a sophisticated evolution in its delivery mechanism, employing an eight-stage fileless attack chain that leaves minimal forensic artifacts.
The infection begins when a victim executes a malicious file disguised as a copyright violation notice, distributed in language-specific variants including German ("Dokumentation über Verstöße gegen Rechte des geistigen Eigentums.exe") and English ("Notice of Alleged Violation of Intellectual Property Rights.exe"). The initial dropper is delivered as a ZIP archive from cdn.eideasrl.it containing a shellcode loader (urlmon.dll), a renamed executable (ADNotificationManager.exe), and supporting files.
Upon execution, a decoy PDF opens to reduce suspicion while background processes initiate the multi-stage payload delivery. The dropper uses curl with a custom User-Agent string "curl/meow_meow" to download an encrypted payload from quickdocshare.com/DQ, disguised as a PDF file (invoice.pdf). The decryption password is retrieved remotely from quickdocshare.com/DQ/key, ensuring the password is never stored on disk. A renamed WinRAR utility (masquerading as FILE_2025년_재직증명서_원본.png) extracts the encrypted archive using the dynamic password, after which the encrypted container is deleted to reduce forensic evidence.
The working directory is changed to C:\Users\Public\Windows\ to mimic legitimate system paths. A renamed Python interpreter (svchost.exe) executes an obfuscated Python loader script (instructions.pdf). This Python loader performs a two-stage AMSI bypass: Stage 1 patches the AmsiScanBuffer entry point with MOV EAX, E_INVALIDARG + JMP instructions, returning a "not malicious" status. Stage 2 dynamically scans forward from the entry point, identifying conditional jumps (JZ/JNZ) and replacing them with unconditional JMPs for bypass persistence.
After disabling AMSI, the Python loader XOR-decrypts embedded .NET assemblies and launches two structurally identical ConfuserEx-obfuscated .NET loaders (Dgrfauysx.exe and Fsywsuac.exe) concurrently for redundancy. Each loader retrieves an encrypted resource blob via ResourceManager.GetObject() using hardcoded resource names. The blob is decrypted using TripleDES-CBC with Base64-encoded key/IV material stored in .NET metadata. The output is a GZip-compressed PE file decompressed via System.IO.Compression.GZipStream. The resulting assembly is reflectively loaded via Assembly.Load() with no disk write. The CLR is bootstrapped using raw COM vtable calls, the payload is constructed as a SAFEARRAY, and AppDomain.Load_3() executes the final PureLog Stealer payload entirely in the managed heap.
Persistence is established via a Registry Run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the value name "_SystemSettings_" pointing to the Python loader location. Execution state is tracked via the AppModel\StateRepository\CacheVersion registry key with a DWORD value of 1337 to prevent duplicate C2 submissions after reboot.
The stealer performs reconnaissance including full-screen desktop capture (converted to PNG and Base64-encoded), hostname and username collection, WMI-based antivirus product enumeration, and external IP discovery. Data is exfiltrated via HTTPS POST to the C2 server at 166.0.184.127 (quickdocshare.com) within a JSON payload. PureLog Stealer itself harvests Chrome browser credentials, extensions, cryptocurrency wallets, and additional system information. The campaign has also been associated with Telegram-based exfiltration channels for operator notifications.
Two distinct infection chain variants have been identified with material operational differences, suggesting campaign evolution from a remote C2-dependent model to a more resilient offline post-dropper execution model. The selective victimology targeting critical sectors indicates deliberate, organized operations rather than opportunistic mass distribution.
MITRE ATT&CK techniques used in TL-2026-0252
collection
T1005 Data from Local System; T1113 Screen Capture
discovery
T1010 Application Window Discovery; T1012 Query Registry; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1120 Peripheral Device Discovery; T1518 Software Discovery
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
persistence
T1547 Boot or Logon Autostart Execution
credential-access
T1555 Credentials from Password Stores
initial-access
defense-impairment
Affected products and versions in PureLog Stealer Multi-Stage Fileless Campaign Using
- Multiple — Windows Endpoints
Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022 - Google — Chrome Browser
Vulnerable versions: All versions (credential theft target)
Remediation for PureLog Stealer Multi-Stage Fileless Campaign Using
Immediate actions
- Block domains quickdocshare.com, bestshoppingday.com, bestshopingday.com, bestsaleshoppingday.com, and cdn.eideasrl.it at DNS and proxy level
- Block IP addresses 166.0.184.127 and 64.40.154.96 at perimeter firewall
- Hunt for User-Agent string 'curl/meow_meow' in proxy and web gateway logs
- Search for registry value '_SystemSettings_' under HKCU Run key across endpoints
- Scan for svchost.exe processes running from C:\Users\Public\Windows\ path
- Quarantine any endpoints with confirmed IOC matches
Workarounds
- Disable macro execution and script interpreters for non-administrative users
- Restrict WinRAR and archive tool execution to approved directories
- Block outbound connections to newly registered domains (NRDs < 30 days)
- Enable PowerShell Constrained Language Mode and Script Block Logging
Longer-term hardening
- Deploy EDR with behavioral detection for in-memory .NET assembly loading
- Implement AMSI integrity monitoring to detect AmsiScanBuffer patching
- Block execution of renamed Python interpreters via application control policies
- Enforce email gateway filtering for copyright-themed lure attachments and links
- Monitor for ConfuserEx-obfuscated .NET binaries in process memory
- Implement network segmentation to limit lateral movement from compromised hosts
- Deploy browser credential protection to prevent stealer access to stored passwords
Timeline of PureLog Stealer Multi-Stage Fileless Campaign Using
- PureCoder malware-as-a-service suite first distributed on underground forums, including PureCrypter and early PureLogs variants
- PureLogs Stealer first formally documented and tracked by security researchers as a distinct infostealer family
- PureRAT and PureLogs campaigns quadruple in volume compared to 2024, primarily targeting Russian business organizations
- Trend Vision One creates detection model 'Executable Download via Google Ads Malvertising' targeting malvertising abuse vectors used in PureLog distribution
- Campaign infrastructure activated with quickdocshare.com, bestshoppingday.com, and bestshopingday.com domains serving encrypted payloads and decryption keys
- Active C2 communications confirmed from targeted organizations in healthcare, government, hospitality, and education sectors via telemetry to 166.0.184.127
- Trend Micro publishes detailed technical analysis of the copyright lure PureLog Stealer campaign, documenting full eight-stage attack chain and dual .NET loader architecture
- As of 2026-05-29, this PureLog Stealer copyright-lure campaign remains ACTIVE: no CVE/patch applies (commodity infostealer via user execution), and the underlying PureCoder MaaS ecosystem is undisrupted and growing per Check Point and Trend Micro. The specific campaign was last publicly confirmed mid-March 2026 with no takedown or successor, though fresh infrastructure confirmation is sparse (medium-high confidence).
Sources cited for PureLog Stealer Multi-Stage Fileless Campaign Using
- Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries
- PureLogs: The Low-Cost Infostealer with a High-Impact Threat
- PureLogs Stealer - Malpedia
- Analysis of the Pure Malware Family: Unique and Growing Threat
- Stealth In Layers: Unmasking The Loader Used In Targeted Email Campaigns
- Don't Judge a PNG by Its Header: PURELOGS Infostealer Analysis
- PureLogs Forensics - Network Traffic Analysis
- PureRAT Malware Spikes 4x in 2025, Deploying PureLogs to Target Russian Firms
- Microsoft Threat Encyclopedia - Trojan:MSIL/PureLogStealer!MTB
- Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries - InfoSecToday
Threats related to PureLog Stealer Multi-Stage Fileless Campaign Using
Detection coverage for TL-2026-0252
As of 2026-03-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0252 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.