PureLog Stealer Multi-Stage Fileless Campaign Using Copyright Infringement Lures

Key facts for PureLog Stealer copyright lures

Detection coverage for PureLog Stealer copyright lures

As of 2026-03-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0252 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PureLog Stealer — Masqueraded Dropper Execution from Public Windows Directory

Detects execution of binaries from C:\Users\Public\Windows\ including the renamed Python interpreter (svchost.exe), ConfuserEx-obfuscated .NET loaders (Dgrfauysx.exe, Fsywsuac.exe), and Python loader scripts masquerading as PDF files. This is the exploitation/initial access phase of the PureLog Stealer multi-stage fileless campaign.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1036.005, T1204.002, T1059.006
• Data sources: sysmon, windows_security, edr
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="C:\\Users\\Public\\Windows\\*" OR Image="*\\Dgrfauysx.exe" OR Image="*\\Fsywsuac.exe" OR CommandLine="*instructions.pdf*" OR (Image="*\\svchost.exe" Image!="C:\\Windows\\System32\\svchost.exe" Image!="C:\\Windows\\SysWOW64\\svchost.exe" ParentImage!="C:\\Windows\\System32\\services.exe")) | eval indicator=case(match(Image,"(?i)Users.Public.Windows"),"masqueraded-public-path", match(Image,"(?i)(Dgrfauysx|Fsywsuac)\.exe"),"confuserex-loader", match(CommandLine,"(?i)instructions\.pdf"),"python-loader-exec", match(Image,"(?i)svchost\.exe"),"svchost-masquerade", 1=1,"suspicious") | table _time Computer User Image ParentImage CommandLine ParentCommandLine Hashes indicator

Microsoft KQL

DeviceProcessEvents | where Timestamp > ago(24h) | where (FolderPath has @"C:\Users\Public\Windows\" or FileName in~ ("Dgrfauysx.exe", "Fsywsuac.exe") or ProcessCommandLine has "instructions.pdf" or (FileName =~ "svchost.exe" and not FolderPath startswith @"C:\Windows\System32\" and not FolderPath startswith @"C:\Windows\SysWOW64\")) | extend Indicator = case(FolderPath has @"C:\Users\Public\Windows\", "masqueraded-public-path", FileName in~ ("Dgrfauysx.exe", "Fsywsuac.exe"), "confuserex-loader", ProcessCommandLine has "instructions.pdf", "python-loader-exec", FileName =~ "svchost.exe", "svchost-masquerade", "suspicious") | project Timestamp, DeviceName, AccountName, FolderPath, FileName, ProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessCommandLine, SHA256, Indicator

Sigma

title: PureLog Stealer — Masqueraded Dropper Execution from Public Windows Directory
id: 3a8e0f4c-5b7d-4e9a-b1c3-d2e4f5a6b7c8
status: experimental
description: Detects execution of binaries from C:\Users\Public\Windows\ or known PureLog Stealer loader filenames indicating initial dropper execution
references:
    - https://www.trendmicro.com/en_us/research/26/c/copyright-lures-mask-a-multistage-purelog-stealer-attack.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/03/20
tags:
    - attack.defense_evasion
    - attack.t1036.005
    - attack.execution
    - attack.t1204.002
    - attack.t1059.006
logsource:
    product: windows
    category: process_creation
detection:
    selection_public_windows:
        Image|contains: '\Users\Public\Windows\'
    selection_known_loaders:
        Image|endswith:
            - '\Dgrfauysx.exe'
            - '\Fsywsuac.exe'
    selection_svchost_masquerade:
        Image|endswith: '\svchost.exe'
    filter_legitimate_svchost:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    selection_python_loader:
        CommandLine|contains: 'instructions.pdf'
    condition: selection_public_windows or selection_known_loaders or (selection_svchost_masquerade and not filter_legitimate_svchost) or selection_python_loader
falsepositives:
    - Custom applications legitimately installed in C:\Users\Public\Windows\
    - Renamed executables by system administrators for testing
level: critical

Known false positives:

• Custom applications legitimately installed in C:\Users\Public\Windows\
• Renamed executables by system administrators for testing purposes

Tuning notes: Exclude known legitimate software that may install to C:\Users\Public\ paths. Add specific ParentImage filters for authorized admin tools. Adjust svchost.exe masquerade detection to account for legitimate non-System32 svchost instances if any exist in your environment.

• 🔒 PureLog Stealer — Renamed Python Interpreter and Dual .NET Loader Execution · unlock with TL Creds
• 🔒 PureLog Stealer — Reflective .NET Assembly Loading and AMSI Tampering Detection · unlock with TL Creds
• 🔒 PureLog Stealer — C2 Network Exfiltration with JSON Payload and Screen Capture · unlock with TL Creds
• 🔒 PureLog Stealer — Suspicious Process Execution with File Extension Mismatch · unlock with TL Creds
• 🔒 PureLog Stealer — AMSI Bypass via AmsiScanBuffer Patching and Script Block Detection · unlock with TL Creds
• 🔒 PureLog Stealer — DNS Resolution and Network Connection to Campaign Infrastructure · unlock with TL Creds
• 🔒 PureLog Stealer — Registry Persistence and AMSI Bypass Indicators · unlock with TL Creds
• 🔒 PureLog Stealer — C2 Communication via Anomalous User-Agent and Known Infrastructure · unlock with TL Creds

Indicators of compromise for PureLog Stealer copyright lures

As of 2026-03-20, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-0252.

Sample indicators (3 of 25)

• IP address: 166.0.184[.]127
• Domain: quickdocshare[.]com
• File hash: 35efc4b75a1d70c38513b4dfe549da417aaa476bf7e9ebd00265aaa8c7295870

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

How PureLog Stealer copyright lures works

PureLog Stealer is a commodity .NET infostealer from the PureCoder malware-as-a-service (MaaS) ecosystem, sold on underground forums for as little as $99/month. This campaign represents a sophisticated evolution in its delivery mechanism, employing an eight-stage fileless attack chain that leaves minimal forensic artifacts.

The infection begins when a victim executes a malicious file disguised as a copyright violation notice, distributed in language-specific variants including German ("Dokumentation über Verstöße gegen Rechte des geistigen Eigentums.exe") and English ("Notice of Alleged Violation of Intellectual Property Rights.exe"). The initial dropper is delivered as a ZIP archive from cdn.eideasrl.it containing a shellcode loader (urlmon.dll), a renamed executable (ADNotificationManager.exe), and supporting files.

Upon execution, a decoy PDF opens to reduce suspicion while background processes initiate the multi-stage payload delivery. The dropper uses curl with a custom User-Agent string "curl/meow_meow" to download an encrypted payload from quickdocshare.com/DQ, disguised as a PDF file (invoice.pdf). The decryption password is retrieved remotely from quickdocshare.com/DQ/key, ensuring the password is never stored on disk. A renamed WinRAR utility (masquerading as FILE_2025년_재직증명서_원본.png) extracts the encrypted archive using the dynamic password, after which the encrypted container is deleted to reduce forensic evidence.

The working directory is changed to C:\Users\Public\Windows\ to mimic legitimate system paths. A renamed Python interpreter (svchost.exe) executes an obfuscated Python loader script (instructions.pdf). This Python loader performs a two-stage AMSI bypass: Stage 1 patches the AmsiScanBuffer entry point with MOV EAX, E_INVALIDARG + JMP instructions, returning a "not malicious" status. Stage 2 dynamically scans forward from the entry point, identifying conditional jumps (JZ/JNZ) and replacing them with unconditional JMPs for bypass persistence.

After disabling AMSI, the Python loader XOR-decrypts embedded .NET assemblies and launches two structurally identical ConfuserEx-obfuscated .NET loaders (Dgrfauysx.exe and Fsywsuac.exe) concurrently for redundancy. Each loader retrieves an encrypted resource blob via ResourceManager.GetObject() using hardcoded resource names. The blob is decrypted using TripleDES-CBC with Base64-encoded key/IV material stored in .NET metadata. The output is a GZip-compressed PE file decompressed via System.IO.Compression.GZipStream. The resulting assembly is reflectively loaded via Assembly.Load() with no disk write. The CLR is bootstrapped using raw COM vtable calls, the payload is constructed as a SAFEARRAY, and AppDomain.Load_3() executes the final PureLog Stealer payload entirely in the managed heap.

Persistence is established via a Registry Run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the value name "_SystemSettings_" pointing to the Python loader location. Execution state is tracked via the AppModel\StateRepository\CacheVersion registry key with a DWORD value of 1337 to prevent duplicate C2 submissions after reboot.

The stealer performs reconnaissance including full-screen desktop capture (converted to PNG and Base64-encoded), hostname and username collection, WMI-based antivirus product enumeration, and external IP discovery. Data is exfiltrated via HTTPS POST to the C2 server at 166.0.184.127 (quickdocshare.com) within a JSON payload. PureLog Stealer itself harvests Chrome browser credentials, extensions, cryptocurrency wallets, and additional system information. The campaign has also been associated with Telegram-based exfiltration channels for operator notifications.

Two distinct infection chain variants have been identified with material operational differences, suggesting campaign evolution from a remote C2-dependent model to a more resilient offline post-dropper execution model. The selective victimology targeting critical sectors indicates deliberate, organized operations rather than opportunistic mass distribution.

MITRE ATT&CK techniques by tactic:

collection

T1005 Data from Local System; T1113 Screen Capture

discovery

T1010 Application Window Discovery; T1012 Query Registry; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1120 Peripheral Device Discovery; T1518 Software Discovery

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1059 Command and Scripting Interpreter; T1204 User Execution

command-and-control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

persistence

T1547 Boot or Logon Autostart Execution

credential-access

T1555 Credentials from Password Stores

initial-access

T1566 Phishing

defense-impairment

T1685 Disable or Modify Tools

Remediation for PureLog Stealer copyright lures

Immediate actions

• Block domains quickdocshare.com, bestshoppingday.com, bestshopingday.com, bestsaleshoppingday.com, and cdn.eideasrl.it at DNS and proxy level
• Block IP addresses 166.0.184.127 and 64.40.154.96 at perimeter firewall
• Hunt for User-Agent string 'curl/meow_meow' in proxy and web gateway logs
• Search for registry value '_SystemSettings_' under HKCU Run key across endpoints
• Scan for svchost.exe processes running from C:\Users\Public\Windows\ path
• Quarantine any endpoints with confirmed IOC matches

Workarounds

• Disable macro execution and script interpreters for non-administrative users
• Restrict WinRAR and archive tool execution to approved directories
• Block outbound connections to newly registered domains (NRDs < 30 days)
• Enable PowerShell Constrained Language Mode and Script Block Logging

Longer-term hardening

• Deploy EDR with behavioral detection for in-memory .NET assembly loading
• Implement AMSI integrity monitoring to detect AmsiScanBuffer patching
• Block execution of renamed Python interpreters via application control policies
• Enforce email gateway filtering for copyright-themed lure attachments and links
• Monitor for ConfuserEx-obfuscated .NET binaries in process memory
• Implement network segmentation to limit lateral movement from compromised hosts
• Deploy browser credential protection to prevent stealer access to stored passwords

Affected and fixed versions

• Multiple — Windows Endpoints
  Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022
• Google — Chrome Browser
  Vulnerable versions: All versions (credential theft target)

Timeline of PureLog Stealer copyright lures

• 2021-03-01 PureCoder malware-as-a-service suite first distributed on underground forums, including PureCrypter and early locked-ioc-25 variants
• 2022-12-01 locked-ioc-25 Stealer first formally documented and tracked by security researchers as a distinct infostealer family
• 2025-05-01 PureRAT and locked-ioc-25 campaigns quadruple in volume compared to 2024, primarily targeting Russian business organizations
• 2026-02-06 Trend Vision One creates detection model 'Executable Download via Google Ads Malvertising' targeting malvertising abuse vectors used in PureLog distribution
• 2026-03-01 Campaign infrastructure activated with locked-ioc-15, locked-ioc-13, and locked-ioc-14 domains serving encrypted payloads and decryption keys
• 2026-03-15 Active C2 communications confirmed from targeted organizations in healthcare, government, hospitality, and education sectors via telemetry to locked-ioc-19
• 2026-03-19 Trend Micro publishes detailed technical analysis of the copyright lure PureLog Stealer campaign, documenting full eight-stage attack chain and dual .NET loader architecture
• 2026-05-29 As of 2026-05-29, this PureLog Stealer copyright-lure campaign remains ACTIVE: no CVE/patch applies (commodity infostealer via user execution), and the underlying PureCoder MaaS ecosystem is undisrupted and growing per Check Point and Trend Micro. The specific campaign was last publicly confirmed mid-March 2026 with no takedown or successor, though fresh infrastructure confirmation is sparse (medium-high confidence).

Sources cited for PureLog Stealer copyright lures

• Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries Trend Micro · Research · 2026-03-19
• PureLogs: The Low-Cost Infostealer with a High-Impact Threat flashpoint.io · Research · 2025-07-15
• PureLogs Stealer - Malpedia malpedia.caad.fkie.fraunhofer.de · Research · 2025-01-01
• Analysis of the Pure Malware Family: Unique and Growing Threat any.run · Research · 2025-06-01
• Don't Judge a PNG by Its Header: PURELOGS Infostealer Analysis swisspost-cybersecurity.ch · Research · 2025-04-01
• PureLogs Forensics - Network Traffic Analysis netresec.com · Research · 2025-07-01
• Microsoft Threat Encyclopedia - Trojan:MSIL/PureLogStealer!MTB Microsoft · Vendor report · 2025-01-01
• Stealth In Layers: Unmasking The Loader Used In Targeted Email Campaigns cyble.com · Blog · 2025-09-01
• PureRAT Malware Spikes 4x in 2025, Deploying PureLogs to Target Russian Firms The Hacker News · News · 2025-05-01
• Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries - InfoSecToday infosectoday.io · News · 2026-03-19

Threats related to PureLog Stealer copyright lures

• Dolphin X Windows Infostealer Adds AI-Driven Victim Profiling and Polymorphic Panel
• SnappyClient C2 Framework — New Implant Delivered via HijackLoader and ClickFix

More from PureCoder

• Pure Logs Stealer - 64-bit .NET infostealer (PureCoder, Pure Crypter, Eazfuscator.NET)

Previous and next in malware

• Infostealer.Speagle — Supply Chain Compromise via Cobra DocGuard Targeting Ballistic Missile Intelligence Previous report
• GhostClaw Supply Chain Campaign: Malicious GitHub Repos and AI Workflow SKILL.md Files Deliver GhostLoader macOS Infostealer via trackpipe[.]dev C2 Next report