Listen to this Post
Introduction
PureLogs is a .NET-based information stealer recently observed in active cybercriminal campaigns. This malware specializes in harvesting sensitive data, including credentials, browser histories, and cryptocurrency wallets. Security researchers are actively analyzing its behavior to develop detection and mitigation strategies.
Learning Objectives
- Understand the structure and functionality of PureLogs.
- Learn detection techniques for .NET-based stealers.
- Explore mitigation strategies to protect against info-stealers.
1. Analyzing PureLogs with PE Tools
Command:
dnSpy PureLogs.exe
Step-by-Step Guide:
1. Download dnSpy, a .NET decompiler.
2. Open the PureLogs executable (`PureLogs.exe`) in dnSpy.
- Navigate through the decompiled code to identify key functions, such as:
– Data exfiltration methods.
– Persistence mechanisms (e.g., registry modifications).
– Anti-analysis checks (e.g., sandbox evasion).
This helps reverse-engineer the malware’s behavior and identify Indicators of Compromise (IoCs).
2. Detecting PureLogs with YARA Rules
YARA Rule:
rule PureLogs_Stealer {
meta:
description = "Detects PureLogs .NET info-stealer"
author = "Your Name"
strings:
$s1 = "PureLogs" nocase
$s2 = "StealerModule" nocase
$s3 = "ExfiltrateData" nocase
condition:
any of them
}
Step-by-Step Guide:
1. Save the rule as `PureLogs_Stealer.yar`.
2. Run the scan using:
yara -r PureLogs_Stealer.yar /path/to/suspicious/files
3. Review matches to confirm PureLogs infection.
3. Monitoring Registry Modifications (Windows)
Command:
Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Format-Table -AutoSize
Step-by-Step Guide:
1. PureLogs often adds persistence via registry keys.
2. Check common auto-run locations (`Run`, `RunOnce`).
3. Investigate any suspicious entries for further analysis.
4. Network Traffic Analysis for Exfiltration
Command (Wireshark Filter):
tcp.dstport == 443 && (http.request || ssl.handshake)
Step-by-Step Guide:
- Capture traffic while executing PureLogs in a sandbox.
- Filter for HTTPS (port 443) traffic, as stealers often use encrypted channels.
- Look for unusual domains or IPs receiving POST requests.
5. Mitigation: Disabling .NET Malware Execution
Command (Windows Defender Attack Surface Reduction):
Add-MpPreference -AttackSurfaceReductionRules_Ids "BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550" -AttackSurfaceReductionRules_Actions Enabled
Step-by-Step Guide:
1. This rule blocks malicious .NET script execution.
2. Apply via Group Policy or PowerShell.
3. Monitor logs for blocked processes.
What Undercode Say:
- Key Takeaway 1: PureLogs is part of a growing trend of .NET-based stealers, making static analysis crucial.
- Key Takeaway 2: Defense requires multi-layered detection, including YARA rules, traffic analysis, and endpoint hardening.
Analysis:
PureLogs demonstrates how malware authors leverage .NET for evasion, as many security tools focus on traditional binaries. Organizations must enhance monitoring for script-based threats and adopt behavioral detection alongside signature-based methods.
Prediction:
Future variants may incorporate more advanced obfuscation, requiring deeper dynamic analysis and AI-driven detection to combat evolving .NET malware.
IT/Security Reporter URL:
Reported By: Gameel Ali – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
