{"id":1,"date":"2025-05-20T15:07:14","date_gmt":"2025-05-20T15:07:14","guid":{"rendered":"http:\/\/inforb-test1.certsign.ro:8080\/?p=1"},"modified":"2025-05-26T08:13:05","modified_gmt":"2025-05-26T08:13:05","slug":"salut-lume","status":"publish","type":"post","link":"https:\/\/inforb.ro\/en\/salut-lume\/","title":{"rendered":"PureLogs, a cheap infostealer targeting the Chrome browser"},"content":{"rendered":"

Lumea amenin\u021b\u0103rilor cibernetice este complex\u0103 \u0219i \u00een continu\u0103 schimbare. Actorii r\u0103u inten\u021biona\u021bi \u00ee\u0219i \u00eembun\u0103t\u0103\u021besc constant metodele, iar noi variante de malware de tip infostealer apar frecvent.<\/p>\n\n\n\n

Infostealerele sunt foarte u\u0219or de operat, ieftine \u0219i au bariere de acces reduse, ceea ce le face extrem de periculoase chiar \u0219i \u00een m\u00e2inile atacatorilor de nivel sc\u0103zut.<\/p>\n\n\n\n

O variant\u0103 recent\u0103, numit\u0103 PureLogs, este un infostealer <\/strong>pe 64 de bi\u021bi, construit \u00een C#, care \u00ee\u0219i \u00eempacheteaz\u0103 componentele \u00een mai multe etape folosind packer-ul comercial .NET Reactor.<\/p>\n\n\n\n

Acest tip de malware are capacitatea de a ob\u021bine informa\u021bii private prin intermediul browserului Chrome. \u00cemparte aceast\u0103 abilitate cu doar c\u00e2teva alte variante de malware, inclusiv Lumma, Vidar \u0219i Meduza.<\/p>\n\n\n\n

\u00cen peisajul actual al amenin\u021b\u0103rilor, este esen\u021bial ca exper\u021bii \u00een securitate s\u0103 r\u0103m\u00e2n\u0103 la curent cu noile variante emergente, precum PureLogs.<\/p>\n\n\n\n

PureLogs \u2013 One of the Cheapest Infostealers<\/strong><\/h2>\n\n\n\n

In 2022, PureLogs was initially offered for sale on underground markets and has since been promoted on various underground forums. It also has an active account and a dedicated marketplace on the clearnet.<\/p>\n\n\n\n

Acest site nu mai permite achizi\u021bii directe, dar redirec\u021bioneaz\u0103 poten\u021bialii clien\u021bi c\u0103tre un bot Telegram pentru suport \u0219i \u00eentreb\u0103ri legate de v\u00e2nz\u0103ri. Cu pre\u021buri \u00eencep\u00e2nd de la 99 de dolari pentru o lun\u0103, 199 de dolari pentru trei luni, 299 de dolari pentru un an \u0219i 499 de dolari pentru un abonament pe via\u021b\u0103, PureLogs este unul dintre cei mai ieftini infostealeri de pe pia\u021b\u0103.<\/p>\n\n\n\n

In addition to the infostealer, the author also sells other \u201cproducts\u201d that provide attackers with access to additional resources, such as a cryptocurrency miner, clipboard content replacement tools, a botnet network capable of DDoS attacks, and a hidden Virtual Network Computing (VNC) client.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Techniques Used By PureLogs<\/strong><\/p>\n\n\n\n

According to a report by the Flashpoint Intel team, PureLogs operates in three stages. The first is the loading and execution phase. The second stage appears to handle anti-sandbox checks and network configuration before loading the final component of the infostealer.<\/p>\n\n\n\n

The infostealer\u2019s code resides in the third stage of the assembly. PureLogs collects the following information:<\/p>\n\n\n\n