Phishing Campaign Uses JavaScript-Driven PureLogs Variant to Steal Data
Summary
FortiGuard Labs details a phishing chain that uses JavaScript, PowerShell and process hollowing to load a fileless PureLogs plugin, which can collect browser, Discord, crypto wallet and application data from Windows systems.
Key points
- FortiGuard Labs analyzed a fake purchase-order email carrying a RAR archive with the malicious JavaScript file kpankocrs.js; the described email was blocked by FortiMail as “virus detected.”
- The JavaScript decrypts and runs a PowerShell script, which uses process hollowing to inject a .NET module into MsBuild.exe.
- A downloader in the injected process contacts a C2 server to retrieve and run a PureLogs plugin in memory.
- The analyzed PureLogs variant can collect browser credentials, cookies and session tokens, Discord data, cryptocurrency wallet information, application credentials and system details.
- The malware compresses and encrypts collected data before sending it to the C2 server in HTTP POST requests.
- The article recommends email filtering, disabling unnecessary script execution, and monitoring for unusual PowerShell activity and process hollowing.
Article Details
- Attack Vectors
- A phishing email disguised as a purchase order delivers a RAR archive containing the malicious JavaScript file kpankocrs.js.
- The JavaScript decrypts and runs an obfuscated PowerShell script from C:\Temp.
- The PowerShell code uses process hollowing to inject .NET modules into a suspended MsBuild.exe process.
- A downloader in the process contacts a C2 server, retrieves a PureLogs plugin, and loads it in memory.
- PureLogs collects system information and browser, Discord, cryptocurrency wallet, and application data, then compresses, encrypts, and sends the data to the C2 server through HTTP POST requests.
- Defensive Notes
- Enforce email filtering to block phishing messages and malicious attachments.
- Disable unnecessary script execution and monitor for anomalous PowerShell activity and process hollowing.
- FortiGuard Labs reports that FortiMail blocked the described phishing email as “virus detected.”
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 07cd03e2082bcb0b890cc59ce4c770d1a095ac6f1ae9cf999f5542555c56f841 | Hash of the PureLogs plugin module zgSGkYYzqVe.dll. |
| SHA256 | 3d510977d60a44322f88100b515f06cb5ed83babc64247068d1a489595faa6c5 | Hash of the malicious kpankocrs.js attachment. |
| SHA256 | 670384fafb23140d96f2f8fe04a13fc8cc8e2a6e5e8c973e39b58d103c5fea92 | Hash of the PowerShell script dropped by the malicious JavaScript. |
| SHA256 | b90988400cced319d260c4937f334ecc364785ed5c593cd2139965e62ca58173 | Hash associated with the runtime payload Iwnflr.exe used in the process-hollowing chain. |
| SHA256 | e20b35a8c30e076cdd0e1df05ba1ff2e418dbd39a674f084787cc0af2fda9e95 | Hash of the Rmiyj.dll downloader module. |
| URL | hxxps[:]//77[.]83[.]39[.]211:8443/application | C2 endpoint receiving collected application credentials. |
| URL | hxxps[:]//77[.]83[.]39[.]211:8443/browser | C2 endpoint receiving collected browser data. |
| URL | hxxps[:]//77[.]83[.]39[.]211:8443/crypto | C2 endpoint receiving collected cryptocurrency wallet data. |
| URL | hxxps[:]//77[.]83[.]39[.]211:8443/discord | C2 endpoint receiving collected Discord data. |
| URL | hxxps[:]//77[.]83[.]39[.]211:8443/filesearch/req | Endpoint listed among URLs associated with the malicious campaign. |
| URL | hxxps[:]//77[.]83[.]39[.]211:8443/finish | Endpoint listed among URLs associated with the malicious campaign. |
| URL | hxxps[:]//77[.]83[.]39[.]211:8443/ping | C2 endpoint used by the downloader to check whether the server is active. |
| URL | hxxps[:]//77[.]83[.]39[.]211:8443/plugin | C2 endpoint used to request and download a plugin module. |
| URL | hxxps[:]//77[.]83[.]39[.]211:8443/userinfo | C2 endpoint listed for campaign data communications. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes obfuscated JavaScript and encrypted, Base64-encoded PowerShell data.T1027.013 · Encrypted/Encoded FileThe malware extracts .NET modules and a downloader from embedded resources, including the resource named Eqxcpvgf.Ybrgdoxas.T1027.015 · CompressionThe malware uses GZip compression for payloads and collected data before encryption or transmission.T1041 · Exfiltration Over C2 ChannelThe malware sends collected data to its C2 server in HTTP POST requests, including requests to /browser, /discord, and /crypto.T1055.012 · Process HollowingThe malware uses process hollowing to deploy .NET modules into a suspended MsBuild.exe process.T1059.001 · PowerShellThe JavaScript drops and executes an obfuscated PowerShell script.T1059.007 · JavaScriptThe attachment contains kpankocrs.js, which runs to decrypt and launch the next stage.T1105 · Ingress Tool TransferThe downloader retrieves a PureLogs plugin module from its C2 server.T1106 · Native APIThe process-hollowing chain invokes CreateProcessA(), ZwUnmapViewOfSection(), ReadProcessMemory(), WriteProcessMemory(), VirtualAllocEx(), GetThreadContext(), SetThreadContext(), and ResumeThread().T1119 · Automated CollectionPureLogs automatically gathers system information and data from browsers, Discord, cryptocurrency wallets, and other applications.T1566.001 · Spearphishing AttachmentThe campaign delivers a malicious RAR attachment in a purchase-order-themed phishing email.
Malware
Vendors
Products
DiscordThe attack chain uses PowerShell, process hollowing, and a downloader to load an in-memory plugin that steals browser, Discord, crypto wallet, and application data from Windows systems.FileZilla#PureLogs #FortiGuardLabs #MsBuild.exeFortiMailThe campaign starts with a phishing email disguised as a purchase order and blocked by FortiMail as “virus detected.”Microsoft EdgeThe parameter “u0020” contains the serialized credentials data collected from the Microsoft Edge browser in the analysis environment.Microsoft WindowsAffected Platforms: Microsoft Windows