# Pure Logs Stealer - 64-bit .NET infostealer (PureCoder, Pure Crypter, Eazfuscator.NET)

> Pure Logs Stealer is a commodity 64-bit .NET information stealer sold by the developer alias PureCoder. It harvests browser credentials, Discord tokens, crypto-wallet data, system information, screenshots and clipboard contents, and exfiltrates them 3DES-encrypted over a raw TCP socket (default port 7702). It was still being delivered in 2026 campaigns using copyright-notice lures and fileless Python/.NET loaders.

- **Published:** 2026-10-19T08:57:49Z
- **Last reviewed:** 2026-10-19T08:57:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3867
- **ID:** TL-2026-3867
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** PureCoder
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Pure Logs Stealer is a malware-as-a-service infostealer that first appeared on hacking forums at the end of October 2022. It is developed and sold by an actor using the alias PureCoder, who also sells Pure Miner, Pure Crypter, Pure hVNC, Blue Loader, an HWID reset tool, a Discord DM worm and Pure Clipper. The wider Pure family has been distributed since March 2021, marketed as 'educational software', and purchases are automated through a Telegram bot, so no direct contact with the developer is needed. ANY.RUN reported Bitcoin wallets tied to the family showing about 250 transactions worth roughly $32,000 at the time of its analysis. The latest stealer version noted in the December 2023 analysis was v3.1.3.

The sample analysed by RussianPanda is a 64-bit .NET binary of slightly over 2 MB. It is obfuscated with Eazfuscator.NET and wrapped with the developer's own Pure Crypter. Costura-embedded dependencies, including sqlite.interop.dll, are unpacked to a %TEMP%\Costura\<hash>\64\ folder. Persistence is established through Registry Run Keys (T1547.001), and a HWID-named value under HKU\Software is used by the malware. The self-delete routine runs a PowerShell command of the form 'Start-Sleep -Seconds 10; Remove-Item -Path ... -Force'. The advertised anti-VM, file grabber, file loader, self-delete and persistence features were reported as unreliable in the analysed build.

Collection is broad. The malware reads passwords and data from Chromium- and Gecko-based browsers (35+ reported), including logins.json and encrypted mnemonics, and queries moz_bookmarks. It extracts data from crypto-wallet browser extensions and application files (48+ wallets reported). It also takes Discord tokens from local storage/leveldb, Outlook profile credentials, FileZilla, WinSCP, Telegram, OpenVPN and ProtonVPN data. It captures screenshots (JPEG) and clipboard contents, and recovers the Windows product key from DigitalProductId, writing it to 'App_Windows Serial Key.txt'. System profiling uses WMI queries (OS, processor, GPU, RAM, AV product), and the HWID is generated by MD5-hashing the CPU ProcessorId.

Exfiltration uses a raw TCP socket (default port 7702, configurable). The data is gzip-compressed and encrypted with 3DES using a key derived from an MD5 hash of a supplied string. A 4-byte length prefix is sent first, then the whole payload in a single block, so a network interruption prevents complete exfiltration. Netresec's PureLogs forensics reporting (July 2025) describes infections that begin with a PureCrypter dropper. The dropper fetches XOR-encoded (keys such as 711 and 414), sometimes reversed, payloads disguised as PDF, DAT, VDF or WAV files from compromised legitimate WordPress sites, then injects the decrypted .NET DLL into InstallUtil.exe or RegAsm.exe. Observed C2 endpoints used ports such as 62520, 62050, 65535, 2080 and 7705 and are listed in the IOCs. Netresec also published JA3 and JA4 TLS fingerprints for the traffic.

Trend Micro (19 March 2026) documented a newer campaign aimed at healthcare, government, hospitality and education organizations in Germany, Canada, the United States and Australia. Victims run executables posing as localized copyright-violation notices, delivered via phishing emails and Google Ads malvertising (gclid/gad_source parameters). The lure opens a decoy PDF, downloads an encrypted 'invoice.pdf' with curl and a custom User-Agent, retrieves the archive password from attacker infrastructure, extracts it with a renamed WinRAR, deletes the container, and launches an obfuscated Python loader via a renamed python.exe. The loader applies a two-stage AMSI bypass and runs two redundant ConfuserEx-obfuscated .NET loaders (Dgrfauysx.exe and Fsywsuac.exe) that decrypt GZip+TripleDES payloads and run PureLog Stealer fully in memory. Persistence is a HKCU Run entry disguised as '_SystemSettings_'. Severity MEDIUM and status MONITORING are analyst judgments.

## MITRE ATT&CK

- T1566 Phishing
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1059.001 PowerShell
- T1047 Windows Management Instrumentation
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1036.003 Rename Legitimate Utilities
- T1555.003 Credentials from Web Browsers
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1095 Non-Application Layer Protocol
- T1573.001 Symmetric Cryptography

## Sources

- [Pure Logs Stealer Fails to Impress (mirror of RussianPanda analysis)](https://www.hendryadrian.com/pure-logs-stealer-fails-to-impress/)
- [Infostealers.com - Pure Logs Stealer](https://www.infostealers.com/?p=1807)
- [Netresec - PureLogs Forensics](https://netresec.com/?b=257eead)
- [Trend Micro - Copyright Lures Mask a Multistage PureLog Stealer Attack](https://www.trendmicro.com/en/research/26/c/copyright-lures-mask-a-multistage-purelog-stealer-attack.html)
- [ANY.RUN - Pure malware family analysis](https://any.run/cybersecurity-blog/?p=6639)
- [RussianPanda95 YARA rule - purelogs_stealer.yar](https://github.com/RussianPanda95/Yara-Rules/blob/main/purelogs_stealer.yar)
- [RussianPanda95 Sigma rule - purelogs_stealer_dll_creation.yaml](https://github.com/RussianPanda95/Sigma-Rules/blob/main/purelogs_stealer_dll_creation.yaml)
- [Joe Sandbox analysis 1398078](https://www.joesandbox.com/analysis/1398078/0/html)
- [MalwareBazaar PureLogs sample](https://bazaar.abuse.ch/sample/6de7285d0cc15c6a4e265c57c3fb973b4751acf8c8dcb3c9271b3f73b3178cf1/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3867