en
PureLog StealerPureLogStealerwin.purelogsPureLogs (also known as PureLog Stealer, PureLogStealer and win.purelogs) is an information-stealing malware family operating under the MaaS model. PureLogs targets browser credentials, cryptocurrency wallets, Browser extension list and metadata, Outlook and other application data, Clipboard contents and System hardware and locale inventory. As of 11/10/2026, CyStack's research records 1 variant, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
PureLogs is a 64-bit C# infostealer in the Pure malware family, distributed since 2022 under a malware-as-a-service subscription model. The stub is obfuscated with ConfuserEx, .NET Reactor, and custom virtualization, with the C2 configuration carried as a Protobuf-serialized, XOR plus 3DES-encrypted blob in the binary resources.
The exfiltrated artifact is a flat JSON log.json with a
nested BotInfo sub-object split into System /
Hardware / Network sections. The top-level fields
carry a Username_Hwid (literal user_<hwid> join), a
StubVersion (e.g. v4.0.1) and a LogFolder whose
path begins with C:\PureLogs v4\Logs\<COUNTRY>\.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
d9e2bb7... | 4,180 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
{ "FirstTime": <value>, "Username_Hwid": <value>, "IPAddress": <value>, "Date": <value>, "StubVersion": <value>, "Country": <value>, "Group": <value>, "Note": <value>, "DomainDetector": <value>, "BrowserPasswords": <value>, "BrowserCookies": <value>, "BrowserCreditCards": <value>, "BrowserExtenstions": <value>, "BrowserExtenstionsNames": <value>, "DesktopCryptoWallets": <value>, "Applications": <value>, "LogFolder": <value>, "BotInfo": { "System": { "WindowsVersion": <value>, "Username": <value>, "Domain": <value>, "Country": <value>, "Antivirus": <value>, "Clipboard": <value> }, "Hardware": { "Cpu": <value>, "Gpu": <value>, "Ram": <value>, "ScreenSize": <value> }, "Network": { "Public_IP": <value>, "Private_IP": <value>, "Gateway": <value> } }}
