Threat Actor Characterization
PureLog Stealer
ID: dce4ea460c69a84b029cf6527ab7d49584199| PureCoder | PureLog | Pu**************** | Pu************** |
| Pu************ | — | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
PureLog Stealer (PureLogs) is a commodity Windows information stealer associated with the broader PureCoder malware ecosystem. Public reporting since 2022 links it to low-cost criminal sales, browser and wallet data theft, and more recent selective campaigns using staged, fileless, or in-memory execution.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1566.001 | Spearphishing Attachment | TA0001 | |
| T1204.002 | Malicious File | TA0002 | |
| T1059.001 | PowerShell | TA0002 |
|
| T1059.007 | JavaScript | TA0002 |
|
| T1027 | Obfuscated Files or Information | TA0005 | |
| T1105 | Ingress Tool Transfer | TA0011 | |
| T1547.001 | Registry Run Keys / Startup Folder | TA0003 TA0004 | |
| T1113 | Screen Capture | TA0009 |
|
| T1082 | System Information Discovery | TA0007 | |
| T1555.003 | Credentials from Web Browsers | TA0006 | |
| T1005 | Data from Local System | TA0009 | |
| T1071.001 | Web Protocols | TA0011 |
Classification: TLP:WHITE - Open Source Intelligence (OSINT)
Category: Cybercrime / Information Stealer / Malware Ecosystem - Origin: Unknown
Author: iQBlack CTI Team
Executive Summary
PureLog Stealer (also referred to in public reporting as PureLogs) is a commodity Windows information stealer associated with the wider “Pure” malware ecosystem marketed and maintained by the operator or developer alias “PureCoder.” Public reporting since 2022 consistently places PureLog in a low-cost criminal tooling stack that also includes PureCrypter, PureHVNC / PureRAT, PureMiner, and related loaders or distribution components. The available evidence supports treating PureLog primarily as a malware product and criminal service component rather than as a single actor or tightly bounded intrusion set.
Operationally, PureLog’s value proposition is straightforward: steal browser credentials and browser artifacts, cryptocurrency wallet data, system and user information, messaging and VPN-related data, and additional material from common end-user applications. Public analysis also indicates that PureLog is modular, can be wrapped or staged through PureCrypter or adjacent loaders, and is attractive to both low-sophistication operators and more capable actors because of its low entry cost, broad data-harvesting scope, and multiple evasive delivery options.
Executive Analyst Brief for CISO — PureLog StealerClassification: TLP:WHITE - Open Source Intelligence (OSINT)What it isPureLog Stealer is a commodity Windows infostealer associated with the broader PureCoder malware ecosystem. It is designed to steal browser credentials, cookies, extensions, cryptocurrency wallet data, system information, messaging-related artifacts, email client data, and VPN-related material. Public reporting since 2022 places it inside a criminal product portfolio that
Hunting Playbook — PureLog StealerScope: Windows endpoints, email telemetry, script execution logs, EDR process trees, registry telemetry, web proxy / DNS / firewall logs, browser credential theft follow-up.Analytical framing: PureLog is a commodity infostealer in the PureCoder ecosystem. Hunts should focus on user-driven staging, script execution, in-memory loaders, suspicious persistence, archive extraction patterns, and post-execution outbound traffic rather than on a single hash or
This appendix provides a practical seed set of indicators and patterns associated with PureLog / PureLogs activity as observed in public reporting. Indicators should be used with context. Several items are campaign-specific and better suited for hunting, pivoting, or enrichment than for long-term blocking.
