New PureLogs Variant Abuses MSBuild to Evade Detection

A new phishing-driven malware campaign distributing a stealthy PureLogs variant that leverages advanced evasion techniques, including process hollowing via MsBuild.exe.

The campaign is designed to steal sensitive data from infected systems while avoiding traditional detection mechanisms through layered obfuscation and fileless execution.

The attack begins with phishing emails disguised as purchase orders, a familiar social engineering tactic. Victims are prompted to open a malicious RAR attachment named similarly to a purchase document.

Although some security systems flag the email as malicious, the campaign demonstrates how convincing lures can still bypass defenses or trick users in less protected environments.

Inside the archive, researchers identified an obfuscated JavaScript file that acts as the initial payload. When executed, the script decrypts embedded PowerShell code and drops it into the Windows Temp directory under a randomized filename. It then launches PowerShell with execution policies bypassed and runs the hidden script.

The PowerShell payload contains encrypted and Base64-encoded data that is decoded and decrypted at runtime using an XOR-based routine. This results in a fileless script executed directly in memory via Invoke-Expression, making it difficult for endpoint security tools to detect.

A key highlight of the attack is the use of process hollowing. The malware loads a .NET module that injects a second payload into a legitimate Windows process, specifically MsBuild.exe.

FortiGuard Labs said ina report shared with GBhackers,a phishing campaign distributing a PureLogs variant designed to collect sensitive data from the victim’s device.

By creating a suspended process and replacing its memory space with malicious code, the attacker ensures the malware runs under a trusted process context. This technique relies on Windows APIs such as CreateProcessA, WriteProcessMemory, and ResumeThread to execute the injected payload seamlessly.

Once inside MsBuild.exe, the malware deploys another .NET module that extracts a downloader component from encrypted resources.

This downloader communicates with a command-and-control server to fetch additional plugins. Communication is protected using AES encryption, with requests structured to include encrypted payloads and random initialization vectors, further complicating network-based detection.

PureLogs Variant Abuses MSBuild

The final stage involves a fileless PureLogs plugin that operates entirely in memory. This module is heavily obfuscated using commercial .NET protection tools, making reverse engineering more challenging. Once executed, it begins collecting extensive data from the victim’s system.

The plugin module (named zgSGkYYzqVe.dll) is a fileless PureLogs variant that resides only in memory.

The malware gathers system information such as OS version, hardware details, username, running processes, and even captures screenshots.

It also extracts sensitive data from a wide range of browsers, including login credentials, cookies, autofill data, and session tokens. Browser databases are accessed directly from local storage paths, enabling credential theft without user interaction.

In addition to browsers, the malware targets applications like Discord, where it harvests authentication tokens and session data, allowing attackers to hijack accounts without passwords.

It also scans for cryptocurrency wallets, extracting private keys, wallet files, and transaction histories, posing a significant financial risk.

All collected data is compressed, encrypted, and transmitted to the attacker’s infrastructure via HTTP POST requests. The modular design allows the malware to dynamically extend functionality by downloading new plugins from the command server.

This campaign highlights the growing sophistication of commodity malware like PureLogs, which now incorporates advanced techniques such as process hollowing, in-memory execution, and multi-layer encryption.

These capabilities make detection significantly harder for traditional security tools.

Organizations should strengthen email filtering, restrict script execution, and monitor abnormal PowerShell activity and suspicious process behavior, especially involving trusted binaries like MsBuild.exe.

IOCs

URLs:

hxxps://77[.]83.39.211:8443/ping
hxxps://77[.]83.39.211:8443/plugin
hxxps://77[.]83.39.211:8443/userinfo
hxxps://77[.]83.39.211:8443/browser
hxxps://77[.]83.39.211:8443/discord
hxxps://77[.]83.39.211:8443/crypto
hxxps://77[.]83.39.211:8443/application
hxxps://77[.]83.39.211:8443/filesearch/req
hxxps://77[.]83.39.211:8443/finish

C2 Server Domain:

hxxps://77[.]83.39.211:8443

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.