Researchers identified a focused malware operation distributing PureLog Stealer, a data-theft malware designed to extract sensitive information from compromised systems. The campaign relies on layered execution techniques and disguised files to avoid detection.
The malware is delivered through files posing as legal copyright violation notices. Once opened, the infection chain unfolds in multiple stages, eventually leading to credential theft, browser data extraction, cryptocurrency wallet harvesting, and system profiling.
What makes this campaign notable is its simplicity combined with effectiveness. PureLog Stealer is inexpensive and easy to operate, which lowers the barrier for attackers while still providing strong evasion capabilities.
Threat Overview
The attack primarily depends on social engineering, where users are tricked into downloading a malicious executable. These files are customized based on the victim’s language, increasing the chances of execution.
Instead of attaching malware directly, attackers typically send phishing emails containing download links. This allows them to host payloads centrally and modify them dynamically.
The infection process is not random. Observed targeting shows a preference for specific sectors and regions, indicating a controlled and selective approach rather than mass distribution.
Targeted Sectors and Regions
The campaign has been observed affecting organizations in:
Industries:
- Healthcare
- Government
- Hospitality
- Education
Countries:
- Germany
- Canada
- United States
- Australia
The use of localized lures and industry targeting strongly suggests deliberate victim selection.
Infection Chain Analysis
The attack follows a structured sequence, where each stage prepares the environment for the next while attempting to remain unnoticed.
Initial Execution
The infection begins when a user manually runs a file disguised as a legal document related to intellectual property violations. No software vulnerability is exploited at this stage — execution depends entirely on user interaction.
Decoy Document
Immediately after execution, a fake PDF file is opened. This document appears harmless and is used to distract the victim while malicious activity runs in the background.
Encrypted Payload Delivery
The malware downloads a file labeled as a PDF, but in reality, it is an encrypted archive. This file is retrieved from attacker-controlled infrastructure using command-line tools.
Dynamic Password Retrieval
Instead of embedding a password inside the malware, the attacker retrieves it remotely. This approach has several advantages:
- Prevents offline analysis
- Allows password rotation per victim
- Gives attackers control over payload activation
This design makes the attack more flexible and harder to investigate.
Payload Extraction via Renamed Tool
A renamed version of a legitimate archive utility (WinRAR) is used to extract the encrypted payload. The file is disguised as an image, making it less suspicious.
This step blends malicious activity with legitimate system behavior, helping it evade detection.
Execution of Python Loader
After extraction, a Python-based loader is executed. It decrypts and launches the final malware payload directly in memory.
The loader also includes techniques to detect virtual environments, helping it avoid sandbox analysis.
Final Payload: PureLog Stealer
The final stage runs entirely in memory. No files are written to disk, which significantly reduces detection by traditional antivirus solutions.
The malware performs:
- Credential theft (browser data, saved passwords)
- Cryptocurrency wallet extraction
- System profiling
- Screenshot capture
- Antivirus enumeration
Technical Characteristics
Key behaviors observed during analysis include:
- DLL sideloading for execution
- Multi-stage payload delivery
- Encrypted payload disguised as documents
- Remote key retrieval for decryption
- Use of legitimate tools for malicious purposes
- Fileless execution through in-memory loading
These techniques collectively reduce visibility and complicate forensic analysis.
Variant Observations
Two variations of the infection chain were identified:
- One version relies on active communication with command-and-control servers
- Another version operates fully offline after initial delivery
The second variant includes hardcoded decryption keys and embedded payloads, making it more self-contained and resilient.
Malvertising Component
In addition to phishing emails, the campaign also uses Google Ads abuse (malvertising).
Attackers purchase ad space and redirect users to malicious download pages. These URLs include tracking parameters such as:
gclidgad_sourcegad_campaignid
This allows attackers to monitor victims and adjust delivery strategies.
Detection logic focuses on identifying executable downloads originating from such URLs, especially when the domain is not trusted.
Telemetry and Behavioral Findings
Endpoint telemetry revealed the following:
- Execution from user download directories
- Use of command-line tools for staged payload delivery
- Network communication with known malicious infrastructure
- Creation of Python runtime components in unusual directories
- PowerShell commands used for antivirus enumeration
Additionally, the malware injects itself into browser processes such as Chrome, using flags that disable sandbox protections and isolate execution environments.
Data Collection and Exfiltration
The malware gathers detailed system information, including:
- Installed antivirus solutions
- Operating system details
- Username and machine identity
- External IP address
- Runtime information
It also captures screenshots and sends all collected data to a command-and-control server via encrypted HTTPS communication.
To avoid duplicate reporting, the malware stores a registry flag after successful data exfiltration.
Persistence Mechanism
Persistence is achieved through registry modifications. The malware adds itself to the system’s autorun entries, ensuring execution on every login.
The naming used mimics legitimate system components, reducing suspicion.
Evasion Techniques
The campaign uses several evasion strategies:
- AMSI bypass to disable Windows Defender scanning
- Heavy obfuscation using Base64 encoding and arithmetic masking
- In-memory execution to avoid file detection
- Multi-stage loaders for redundancy
- Use of legitimate binaries to mask behavior
These methods indicate a well-designed attempt to bypass both automated and manual analysis.
Our Assessment
From our perspective, this campaign reflects a shift in how commodity malware is being used. While PureLog Stealer itself is not highly sophisticated, the way it is delivered shows careful planning.
The attackers are not relying on advanced exploits. Instead, they are combining simple tools with smart delivery techniques. This makes the attack both scalable and effective.
What stands out is the balance between cost and capability. By using publicly available tools, lightweight obfuscation, and staged execution, attackers achieve a level of stealth that rivals more advanced threats.
The selective targeting of industries like healthcare and government also suggests that attackers are prioritizing valuable data rather than spreading malware blindly.
Overall, this campaign highlights an important trend: modern threats do not always need complex code. Well-structured delivery, social engineering, and controlled infrastructure can be just as dangerous.
Conclusion
The PureLog Stealer campaign demonstrates how layered execution, social engineering, and fileless techniques can be combined into a highly effective attack chain.
Its ability to adapt delivery methods, evade detection, and operate in memory makes it a serious threat, especially for organizations with limited visibility into endpoint behavior.
Detection strategies should focus on:
- Behavioral monitoring
- Network traffic analysis
- Suspicious process chains
- Unusual use of legitimate tools
Proactive threat hunting and endpoint telemetry remain critical in identifying and stopping such campaigns before data exfiltration occurs.
