We identified a targeted malware campaign delivering PureLog Stealer, an information-stealing malware that uses multi-stage packed assemblies to harvest sensitive data, including Chrome browser credentials, extensions, cryptocurrency wallets, and system information, through a file disguised as a legal copyright violation notice. The attack likely relies on phishing emails that lure victims into downloading a malicious executable tailored to the victim’s local language.
Once executed, the malware deploys a multistage infection chain designed for evasion. Notably, it downloads an encrypted payload disguised as a PDF file, then retrieves the decryption password remotely from attacker-controlled infrastructure. Instead of using built-in decryption code, the campaign abuses a renamed WinRAR utility disguised as a PNG image to extract the payload.
The extracted payload launches a Python-based loader that decrypts and executes the final .NET PureLog Stealer malware in memory. The routine also incorporates anti-virtual machine techniques to evade automated analysis environments.