Threat reportMalwareTL-2026-3867
Pure Logs Stealer - 64-bit .NET infostealer (PureCoder, Pure Crypter, Eazfuscator.NET)
Pure Logs Stealer (TL-2026-3867), also tracked as PureLogs, is a medium-severity malware campaign, first published 2026-10-19. It is attributed to PureCoder with low confidence, affects Microsoft Windows, maps to 20 MITRE ATT&CK techniques (T1005, T1027, T1036.003), and is covered by 9 detection rules and 35 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 20MITRE ATT&CK
- Actors
- 1PureCoder
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 35Indicators of compromise
Key facts for TL-2026-3867
- Threat ID
- TL-2026-3867
- Also known as
- PureLogs, PureLogs Stealer, PureLog Stealer
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- PureCoder
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, cryptocurrency, health, government administration, hospitality, education, general-consumer
- Target regions
- Global, germany, canada, united states of america, australia
- Detection rules
- 9
- Indicators of compromise
- 35
Malware and tooling in Pure Logs Stealer
Malware and tooling: PureCrypter, PureLogs Stealer, ConfuserEx
How Pure Logs Stealer works
Pure Logs Stealer is a commodity 64-bit .NET information stealer sold by the developer alias PureCoder. It harvests browser credentials, Discord tokens, crypto-wallet data, system information, screenshots and clipboard contents, and exfiltrates them 3DES-encrypted over a raw TCP socket (default port 7702). It was still being delivered in 2026 campaigns using copyright-notice lures and fileless Python/.NET loaders.
Pure Logs Stealer is a malware-as-a-service infostealer that first appeared on hacking forums at the end of October 2022. It is developed and sold by an actor using the alias PureCoder, who also sells Pure Miner, Pure Crypter, Pure hVNC, Blue Loader, an HWID reset tool, a Discord DM worm and Pure Clipper. The wider Pure family has been distributed since March 2021, marketed as 'educational software', and purchases are automated through a Telegram bot, so no direct contact with the developer is needed. ANY.RUN reported Bitcoin wallets tied to the family showing about 250 transactions worth roughly $32,000 at the time of its analysis. The latest stealer version noted in the December 2023 analysis was v3.1.3.
The sample analysed by RussianPanda is a 64-bit .NET binary of slightly over 2 MB. It is obfuscated with Eazfuscator.NET and wrapped with the developer's own Pure Crypter. Costura-embedded dependencies, including sqlite.interop.dll, are unpacked to a %TEMP%\Costura\<hash>\64\ folder. Persistence is established through Registry Run Keys (T1547.001), and a HWID-named value under HKU\Software is used by the malware. The self-delete routine runs a PowerShell command of the form 'Start-Sleep -Seconds 10; Remove-Item -Path ... -Force'. The advertised anti-VM, file grabber, file loader, self-delete and persistence features were reported as unreliable in the analysed build.
Collection is broad. The malware reads passwords and data from Chromium- and Gecko-based browsers (35+ reported), including logins.json and encrypted mnemonics, and queries moz_bookmarks. It extracts data from crypto-wallet browser extensions and application files (48+ wallets reported). It also takes Discord tokens from local storage/leveldb, Outlook profile credentials, FileZilla, WinSCP, Telegram, OpenVPN and ProtonVPN data. It captures screenshots (JPEG) and clipboard contents, and recovers the Windows product key from DigitalProductId, writing it to 'App_Windows Serial Key.txt'. System profiling uses WMI queries (OS, processor, GPU, RAM, AV product), and the HWID is generated by MD5-hashing the CPU ProcessorId.
Exfiltration uses a raw TCP socket (default port 7702, configurable). The data is gzip-compressed and encrypted with 3DES using a key derived from an MD5 hash of a supplied string. A 4-byte length prefix is sent first, then the whole payload in a single block, so a network interruption prevents complete exfiltration. Netresec's PureLogs forensics reporting (July 2025) describes infections that begin with a PureCrypter dropper. The dropper fetches XOR-encoded (keys such as 711 and 414), sometimes reversed, payloads disguised as PDF, DAT, VDF or WAV files from compromised legitimate WordPress sites, then injects the decrypted .NET DLL into InstallUtil.exe or RegAsm.exe. Observed C2 endpoints used ports such as 62520, 62050, 65535, 2080 and 7705 and are listed in the IOCs. Netresec also published JA3 and JA4 TLS fingerprints for the traffic.
Trend Micro (19 March 2026) documented a newer campaign aimed at healthcare, government, hospitality and education organizations in Germany, Canada, the United States and Australia. Victims run executables posing as localized copyright-violation notices, delivered via phishing emails and Google Ads malvertising (gclid/gad_source parameters). The lure opens a decoy PDF, downloads an encrypted 'invoice.pdf' with curl and a custom User-Agent, retrieves the archive password from attacker infrastructure, extracts it with a renamed WinRAR, deletes the container, and launches an obfuscated Python loader via a renamed python.exe. The loader applies a two-stage AMSI bypass and runs two redundant ConfuserEx-obfuscated .NET loaders (Dgrfauysx.exe and Fsywsuac.exe) that decrypt GZip+TripleDES payloads and run PureLog Stealer fully in memory. Persistence is a HKCU Run entry disguised as '_SystemSettings_'. Severity MEDIUM and status MONITORING are analyst judgments.
MITRE ATT&CK techniques used in TL-2026-3867
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036.003 Rename Legitimate Utilities; T1055 Process Injection; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File
Discovery
T1082 System Information Discovery
Command and Control
T1095 Non-Application Layer Protocol; T1573.001 Symmetric Cryptography
Credential Access
T1528 Steal Application Access Token; T1555.003 Credentials from Web Browsers
Persistence
T1547.001 Registry Run Keys / Startup Folder
Initial Access
defense-impairment
Affected products and versions in Pure Logs Stealer
- Microsoft — Windows
Vulnerable versions: Windows 64-bit endpoints (no vulnerability exploited; malware executes on user-launched binary)
Remediation for Pure Logs Stealer
Immediate actions
- Block the listed C2 IP:port pairs and the campaign domains at the perimeter and review proxy/firewall logs for historical connections
- Isolate hosts showing InstallUtil.exe or RegAsm.exe with outbound TCP connections to non-standard ports
- Reset browser-stored passwords, revoke Discord tokens and active sessions, and move crypto-wallet assets from hosts suspected of compromise
- Hunt for sqlite.interop.dll creation under %TEMP%\Costura, for 'App_Windows Serial Key.txt', and for HKCU Run values named '_SystemSettings_'
Workarounds
- Restrict execution of unsigned binaries from user-writable paths via application control
- Alert on registry Run key additions that point to %AppData% or %TEMP% paths
Longer-term hardening
- Deploy EDR with .NET injection, AMSI-tampering and Run-key persistence detection
- Disable browser password storage in managed environments and enforce MFA with hardware-bound credentials
- Deploy the public YARA and Sigma rules from RussianPanda95 and monitor for PowerShell Start-Sleep/Remove-Item self-delete patterns
- Restrict outbound TCP to non-standard ports from user workstations
- Alert on executable downloads arriving via ad-click URLs and on renamed WinRAR/python.exe binaries in user-writable paths
Timeline of Pure Logs Stealer
- ANY.RUN reports the Pure malware family (PureCrypter and related tools) has been distributed since March 2021 (day approximate), marketed as 'educational software' and paid for in cryptocurrency.
- Pure Logs Stealer first appears on hacking forums at the end of October 2022 (day approximate), sold by the alias PureCoder, with purchases automated via a Telegram bot.
- Public YARA (purelogs_stealer.yar) and Sigma (purelogs_stealer_dll_creation.yaml) detection rules referenced by the report are available from the RussianPanda95 repositories.
- Latest stealer version noted in the analysis is v3.1.3. Advertised anti-VM, file grabber and loader features are reported as unreliable in the analysed build.
- RussianPanda publishes 'Pure Logs Stealer Fails to Impress', analysing the Eazfuscator.NET-obfuscated, Pure Crypter-wrapped sample with 3DES-over-TCP exfiltration on default port 7702.
- Netresec publishes 'PureLogs Forensics', documenting PureCrypter droppers fetching XOR-encoded payloads from compromised WordPress sites, injection into InstallUtil.exe/RegAsm.exe, C2 IP:port pairs and JA3/JA4 fingerprints.
- Netresec adds new payload samples (a XOR-decrypted DLL from Cxqyoub.dat and a DLL from a reversed Qlwxqgsag.dat); the article continues to be updated through 2025-07-31.
- Trend Micro publishes 'Copyright Lures Mask a Multistage PureLog Stealer Attack': localized copyright-notice lures, Python loader, AMSI bypass and dual ConfuserEx .NET loaders deliver PureLog Stealer in memory to healthcare, government, hospitality and education targets in DE, CA, US and AU.
- Threadlinqs opens tracking (status MONITORING) as a malware-family analysis covering the 2023 analysis, 2025 forensics and 2026 campaign reporting.
Sources cited for Pure Logs Stealer
- Pure Logs Stealer Fails to Impress (mirror of RussianPanda analysis)
- Infostealers.com - Pure Logs Stealer
- Netresec - PureLogs Forensics
- Trend Micro - Copyright Lures Mask a Multistage PureLog Stealer Attack
- ANY.RUN - Pure malware family analysis
- RussianPanda95 YARA rule - purelogs_stealer.yar
- RussianPanda95 Sigma rule - purelogs_stealer_dll_creation.yaml
- Joe Sandbox analysis 1398078
- MalwareBazaar PureLogs sample
Detection coverage for TL-2026-3867
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3867 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.