Threat Actors Hiding stealthy PURELOGS Payload Within a Weaponized PNG File

PURELOGS Infostealer Delivery through Weaponized PNG Files

Recent analysis has uncovered a sophisticated attack campaign utilizing a novel method for deploying the PURELOGS infostealer. This malware, available as a service on underground platforms, is being distributed through weaponized PNG files hosted on legitimate infrastructures to evade detection systems.

The campaign begins with phishing emails masquerading as pharmaceutical invoices, which include a malicious ZIP file. This file initiates a multi-stage attack designed to bypass traditional security controls. Upon execution, a JScript dropper reaches out to archive.org to download what appears to be an innocuous image file.

This polyglot PNG file contains a hidden Base64-encoded payload, embedded after the official image data, allowing it to display normally while concealing malicious code from users and security tools.

Technical Analysis by Swiss Post Cybersecurity

Security analysts from Swiss Post Cybersecurity identified and analyzed the campaign, noting the malware's ability to bypass multiple layers of obfuscation to reveal the PURELOGS core. This approach combines known malware with innovative staging infrastructure to enhance evasion and delivery success.

Additionally, the attack employs fileless execution techniques, with the PowerShell payload operating solely in memory, rendering traditional file-based antivirus measures ineffective.

PURELOGS is offered as Malware-as-a-Service, with subscription rates starting at $150 per month, making it accessible to a broad range of operators. This accessibility poses threats from both sophisticated attackers and less experienced users employing the same tools.

Detection Evasion through Polyglot PNG Architecture

The campaign's innovation lies in leveraging PNG files to conceal the PURELOGS payload while maintaining file integrity. The process involves downloading a PNG image from archive.org, a seemingly benign action that doesn't raise flags during network analysis.

The Base64-encoded payload is embedded within the PNG file structure, specifically after the IEND chunk, and is extracted using regex pattern matching. This ensures the malware code remains undetected on disk, as it is executed in memory through .NET Reflection.

The strategy of exploiting archive.org's reputation demonstrates how attackers utilize trusted infrastructures to mask malicious activities.

Based on reporting by Cyber Security News.