# PureLog Stealer Multi-Stage Fileless Campaign Using Copyright Infringement Lures

> An active multi-stage attack campaign delivers PureLog Stealer entirely in memory using encrypted, fileless techniques. The campaign uses language-matched copyright infringement lures to target healthcare, government, hospitality, and education sectors across Germany, Canada, the United States, and Australia, featuring AMSI bypass, XOR and TripleDES-CBC encryption, dual .NET loader chains, and remote decryption key retrieval.

- **Published:** 2026-03-20T12:00:00Z
- **Last reviewed:** 2026-03-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0252
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-purelog-stealer-copyright-lures-tl-2026-0252.webp?v=79c2ee3d (Threadlinqs threat intel: PureLog Stealer AMSI Bypass Loader Chain: Detection & IOCs (TL-2026-0252) — High severity, 25 IOCs, 9 detection rules.)
- **ID:** TL-2026-0252
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** PureCoder (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

PureLog Stealer is a commodity .NET infostealer from the PureCoder malware-as-a-service (MaaS) ecosystem, sold on underground forums for as little as $99/month. This campaign represents a sophisticated evolution in its delivery mechanism, employing an eight-stage fileless attack chain that leaves minimal forensic artifacts.

The infection begins when a victim executes a malicious file disguised as a copyright violation notice, distributed in language-specific variants including German ("Dokumentation über Verstöße gegen Rechte des geistigen Eigentums.exe") and English ("Notice of Alleged Violation of Intellectual Property Rights.exe"). The initial dropper is delivered as a ZIP archive from cdn.eideasrl.it containing a shellcode loader (urlmon.dll), a renamed executable (ADNotificationManager.exe), and supporting files.

Upon execution, a decoy PDF opens to reduce suspicion while background processes initiate the multi-stage payload delivery. The dropper uses curl with a custom User-Agent string "curl/meow_meow" to download an encrypted payload from quickdocshare.com/DQ, disguised as a PDF file (invoice.pdf). The decryption password is retrieved remotely from quickdocshare.com/DQ/key, ensuring the password is never stored on disk. A renamed WinRAR utility (masquerading as FILE_2025년_재직증명서_원본.png) extracts the encrypted archive using the dynamic password, after which the encrypted container is deleted to reduce forensic evidence.

The working directory is changed to C:\Users\Public\Windows\ to mimic legitimate system paths. A renamed Python interpreter (svchost.exe) executes an obfuscated Python loader script (instructions.pdf). This Python loader performs a two-stage AMSI bypass: Stage 1 patches the AmsiScanBuffer entry point with MOV EAX, E_INVALIDARG + JMP instructions, returning a "not malicious" status. Stage 2 dynamically scans forward from the entry point, identifying conditional jumps (JZ/JNZ) and replacing them with unconditional JMPs for bypass persistence.

After disabling AMSI, the Python loader XOR-decrypts embedded .NET assemblies and launches two structurally identical ConfuserEx-obfuscated .NET loaders (Dgrfauysx.exe and Fsywsuac.exe) concurrently for redundancy. Each loader retrieves an encrypted resource blob via ResourceManager.GetObject() using hardcoded resource names. The blob is decrypted using TripleDES-CBC with Base64-encoded key/IV material stored in .NET metadata. The output is a GZip-compressed PE file decompressed via System.IO.Compression.GZipStream. The resulting assembly is reflectively loaded via Assembly.Load() with no disk write. The CLR is bootstrapped using raw COM vtable calls, the payload is constructed as a SAFEARRAY, and AppDomain.Load_3() executes the final PureLog Stealer payload entirely in the managed heap.

Persistence is established via a Registry Run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the value name "_SystemSettings_" pointing to the Python loader location. Execution state is tracked via the AppModel\StateRepository\CacheVersion registry key with a DWORD value of 1337 to prevent duplicate C2 submissions after reboot.

The stealer performs reconnaissance including full-screen desktop capture (converted to PNG and Base64-encoded), hostname and username collection, WMI-based antivirus product enumeration, and external IP discovery. Data is exfiltrated via HTTPS POST to the C2 server at 166.0.184.127 (quickdocshare.com) within a JSON payload. PureLog Stealer itself harvests Chrome browser credentials, extensions, cryptocurrency wallets, and additional system information. The campaign has also been associated with Telegram-based exfiltration channels for operator notifications.

Two distinct infection chain variants have been identified with material operational differences, suggesting campaign evolution from a remote C2-dependent model to a more resilient offline post-dropper execution model. The selective victimology targeting critical sectors indicates deliberate, organized operations rather than opportunistic mass distribution.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1518 Software Discovery
- T1057 Process Discovery
- T1012 Query Registry
- T1010 Application Window Discovery
- T1087 Account Discovery
- T1120 Peripheral Device Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PureLog Stealer — Masqueraded Dropper Execution from Public Windows Directory** (`TL-2026-0252-SPL-001`)

Detects execution of binaries from C:\Users\Public\Windows\ including the renamed Python interpreter (svchost.exe), ConfuserEx-obfuscated .NET loaders (Dgrfauysx.exe, Fsywsuac.exe), and Python loader scripts masquerading as PDF files. This is the exploitation/initial access phase of the PureLog Stealer multi-stage fileless campaign.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1036.005, T1204.002, T1059.006
- **Data sources:** sysmon, windows_security, edr
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="C:\\Users\\Public\\Windows\\*" OR Image="*\\Dgrfauysx.exe" OR Image="*\\Fsywsuac.exe" OR CommandLine="*instructions.pdf*" OR (Image="*\\svchost.exe" Image!="C:\\Windows\\System32\\svchost.exe" Image!="C:\\Windows\\SysWOW64\\svchost.exe" ParentImage!="C:\\Windows\\System32\\services.exe")) | eval indicator=case(match(Image,"(?i)Users.Public.Windows"),"masqueraded-public-path", match(Image,"(?i)(Dgrfauysx|Fsywsuac)\.exe"),"confuserex-loader", match(CommandLine,"(?i)instructions\.pdf"),"python-loader-exec", match(Image,"(?i)svchost\.exe"),"svchost-masquerade", 1=1,"suspicious") | table _time Computer User Image ParentImage CommandLine ParentCommandLine Hashes indicator
```

### Microsoft KQL

```kql
DeviceProcessEvents | where Timestamp > ago(24h) | where (FolderPath has @"C:\Users\Public\Windows\" or FileName in~ ("Dgrfauysx.exe", "Fsywsuac.exe") or ProcessCommandLine has "instructions.pdf" or (FileName =~ "svchost.exe" and not FolderPath startswith @"C:\Windows\System32\" and not FolderPath startswith @"C:\Windows\SysWOW64\")) | extend Indicator = case(FolderPath has @"C:\Users\Public\Windows\", "masqueraded-public-path", FileName in~ ("Dgrfauysx.exe", "Fsywsuac.exe"), "confuserex-loader", ProcessCommandLine has "instructions.pdf", "python-loader-exec", FileName =~ "svchost.exe", "svchost-masquerade", "suspicious") | project Timestamp, DeviceName, AccountName, FolderPath, FileName, ProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessCommandLine, SHA256, Indicator
```

### Sigma

```yaml
title: PureLog Stealer — Masqueraded Dropper Execution from Public Windows Directory
id: 3a8e0f4c-5b7d-4e9a-b1c3-d2e4f5a6b7c8
status: experimental
description: Detects execution of binaries from C:\Users\Public\Windows\ or known PureLog Stealer loader filenames indicating initial dropper execution
references:
    - https://www.trendmicro.com/en_us/research/26/c/copyright-lures-mask-a-multistage-purelog-stealer-attack.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/03/20
tags:
    - attack.defense_evasion
    - attack.t1036.005
    - attack.execution
    - attack.t1204.002
    - attack.t1059.006
logsource:
    product: windows
    category: process_creation
detection:
    selection_public_windows:
        Image|contains: '\Users\Public\Windows\'
    selection_known_loaders:
        Image|endswith:
            - '\Dgrfauysx.exe'
            - '\Fsywsuac.exe'
    selection_svchost_masquerade:
        Image|endswith: '\svchost.exe'
    filter_legitimate_svchost:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    selection_python_loader:
        CommandLine|contains: 'instructions.pdf'
    condition: selection_public_windows or selection_known_loaders or (selection_svchost_masquerade and not filter_legitimate_svchost) or selection_python_loader
falsepositives:
    - Custom applications legitimately installed in C:\Users\Public\Windows\
    - Renamed executables by system administrators for testing
level: critical
```

**Known false positives:**

- Custom applications legitimately installed in C:\Users\Public\Windows\
- Renamed executables by system administrators for testing purposes

**Tuning notes:** Exclude known legitimate software that may install to C:\Users\Public\ paths. Add specific ParentImage filters for authorized admin tools. Adjust svchost.exe masquerade detection to account for legitimate non-System32 svchost instances if any exist in your environment.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PureLog Stealer — Renamed Python Interpreter and Dual .NET Loader Execution (locked: unlock with TL Creds)
- PureLog Stealer — Reflective .NET Assembly Loading and AMSI Tampering Detection (locked: unlock with TL Creds)
- PureLog Stealer — C2 Network Exfiltration with JSON Payload and Screen Capture (locked: unlock with TL Creds)
- PureLog Stealer — Suspicious Process Execution with File Extension Mismatch (locked: unlock with TL Creds)
- PureLog Stealer — AMSI Bypass via AmsiScanBuffer Patching and Script Block Detection (locked: unlock with TL Creds)
- PureLog Stealer — DNS Resolution and Network Connection to Campaign Infrastructure (locked: unlock with TL Creds)
- PureLog Stealer — Registry Persistence and AMSI Bypass Indicators (locked: unlock with TL Creds)
- PureLog Stealer — C2 Communication via Anomalous User-Agent and Known Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `166.0.184[.]127`
- Domain: `quickdocshare[.]com`
- File hash: `35efc4b75a1d70c38513b4dfe549da417aaa476bf7e9ebd00265aaa8c7295870`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries](https://www.trendmicro.com/en_us/research/26/c/copyright-lures-mask-a-multistage-purelog-stealer-attack.html)
- [PureLogs: The Low-Cost Infostealer with a High-Impact Threat](https://flashpoint.io/blog/purelogs-low-cost-infostealer-high-impact-threat/)
- [PureLogs Stealer - Malpedia](https://malpedia.caad.fkie.fraunhofer.de/details/win.purelogs)
- [Analysis of the Pure Malware Family: Unique and Growing Threat](https://any.run/cybersecurity-blog/pure-malware-family-analysis/)
- [Stealth In Layers: Unmasking The Loader Used In Targeted Email Campaigns](https://cyble.com/blog/stealth-in-layers-unmasking-loader-in-targeted-email-campaigns/)
- [Don't Judge a PNG by Its Header: PURELOGS Infostealer Analysis](https://www.swisspost-cybersecurity.ch/news/purelogs-infostealer-analysis-dont-judge-a-png-by-its-header)
- [PureLogs Forensics - Network Traffic Analysis](https://www.netresec.com/?page=Blog&month=2025-07&post=PureLogs-Forensics)
- [PureRAT Malware Spikes 4x in 2025, Deploying PureLogs to Target Russian Firms](https://thehackernews.com/2025/05/purerat-malware-spikes-4x-in-2025.html)
- [Microsoft Threat Encyclopedia - Trojan:MSIL/PureLogStealer!MTB](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:MSIL/PureLogStealer!MTB)
- [Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries - InfoSecToday](https://www.infosectoday.io/copyright-lures-mask-a-multi-stage-purelog-stealer-attack-on-key-industries/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0252