PawsRunner Uses PNG Steganography to Deliver PureLogs Infostealer
Summary
FortiGuard Labs details a Windows phishing chain using an invoice-themed TXZ attachment, hidden JavaScript commands and the PawsRunner loader to deploy PureLogs, which collects browser, wallet and app data and exfiltrates it over HTTPS.
Key points
- The campaign begins with a phishing email carrying an invoice-themed TXZ archive targeting Windows users.
- JavaScript hides commands in environment variables and launches hidden PowerShell; the resulting .NET assembly is executed through reflection.
- PawsRunner retrieves payloads using multiple network APIs and extracts encrypted data from PNG images using iTXt and IEND markers.
- The final payload, PureLogs, decrypts and loads its core DLL in memory; the analyzed configuration appears to be version 5.0.0.
- PureLogs collects system information and data from browsers, crypto wallets, communication apps, VPN tools and other applications, then sends it to its C2 over HTTP/HTTPS.
- Fortinet reports antivirus detections and an IPS signature for PureLogs C2 communications, and says its products can block the unusual TXZ attachment format.
Article Details
- Attack Vectors
- A phishing email uses an invoice-themed lure to deliver a TXZ archive attachment to Microsoft Windows users.
- JavaScript in the archive stores obfuscated commands in Process environment variables and launches hidden PowerShell and headless conhost.exe processes.
- PawsRunner retrieves payload data from URLs and extracts encrypted content concealed in PNG image chunks.
- PureLogs downloads and loads its core DLL in memory, then collects browser, wallet, communication-app, VPN, and file data for exfiltration over HTTP/HTTPS.
- Defensive Notes
- Fortinet recommends blocking the unusual TXZ attachment format and reports antivirus detections for the described malware.
- FortiGuard Labs provides the Purelogs.Botnet IPS signature to block communications with the PureLogs C2 network.
- Fortinet states that FortiGate, FortiMail, FortiClient, and FortiEDR support its FortiGuard Antivirus Service.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 5[.]101[.]84[.]202 | C2 server used by the campaign, according to the article's IOC section. |
| SHA256 | 0fcb86ae384e9975933314ac2a231f0ff46c0208556bf4a16f096a642d3f505e | Malware sample SHA256 listed in the article's IOC section. |
| SHA256 | 1b730de72f921458b6b162b105a9521a931f07e19d3cac53207c7a8efbc412f9 | Malware sample SHA256 listed in the article's IOC section. |
| SHA256 | 6910d27b9e1dc2229a8c280f5d0cea85146d50274c56a4d9a5b8d1793505b1b9 | Malware sample SHA256 listed in the article's IOC section. |
| SHA256 | 8d0bcde739929fe41a6bcaaa62f7cba802af90b2ba8dea6ed1a4821236cdd588 | Malware sample SHA256 listed in the article's IOC section. |
| SHA256 | 93724f1a9ad3a28c171927fc449ac34dc6ca890f915f00210e8b305577388c6e | Malware sample SHA256 listed in the article's IOC section. |
| SHA256 | e2308749f6b7b7573009d0cac6616a6aa83cecb1f2933e868776400d122c86ec | Malware sample SHA256 listed in the article's IOC section. |
| URL | hxxps[:]//everycarebd[.]com/imagelkjh0987[.]png | PNG payload URL identified as a steganographic carrier for encrypted payload data. |
MITRE ATT&CK
T1005 · Data from Local SystemPureLogs harvests local browser, wallet, communication-app, and file data from the victim's machine.T1027 · Obfuscated Files or InformationThe JavaScript obscures commands using garbled Process environment variables and irrelevant multilingual comments.T1027.003 · SteganographyPawsRunner conceals encrypted payload data in PNG images and locates it using iTXt and IEND chunks.T1041 · Exfiltration Over C2 ChannelPureLogs sends harvested victim data to its C2 server through HTTP requests.T1059.001 · PowerShellThe archive's JavaScript invokes PowerShell with a hidden-window flag to decode and stage the payload.T1071.001 · Web ProtocolsPureLogs uses HTTP/HTTPS requests for C2 connectivity checks, payload retrieval, and communications.T1082 · System Information DiscoveryPureLogs uses WMI to profile the victim system and gather system information.T1105 · Ingress Tool TransferPawsRunner downloads next-stage content from configured URLs, with fallback URLs available in its configuration.T1119 · Automated CollectionPureLogs uses asynchronous tasks to collect browser, application, and file-search data.T1129 · Shared ModulesThe loader loads native libraries and resolves addresses for required API functions.T1140 · Deobfuscate/Decode Files or InformationThe chain decodes and decrypts payloads, including AES decryption and Gzip decompression.T1564.003 · Hidden WindowExecution is concealed by launching PowerShell with -w hidden and conhost.exe in headless mode.T1566.001 · Spearphishing AttachmentThe campaign begins with a phishing email carrying an invoice-themed TXZ archive attachment.
Malware
PawsRunnerFortiGuard Labs uncovered a phishing campaign that delivers a TXZ archive, uses environment variables and a steganography loader named PawsRunner, and ultimately deploys the .NET infostealer PureLogs.PureLogs StealerFortiGuard Labs uncovered a phishing campaign that delivers a TXZ archive, uses environment variables and a steganography loader named PawsRunner, and ultimately deploys the .NET infostealer PureLogs.
Vendors
Products
Eziriz .NET ReactorThe final payload is PureLogs, a .NET infostealer protected with .NET Reactor and configured through Protobuf serialization.FortiClientFortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard Antivirus Service.FortiEDRFortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard Antivirus Service.FortiMailFortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard Antivirus Service.Fortinet FortiGateFortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard Antivirus Service.Microsoft WindowsFortiGuard Labs identified a phishing campaign targeting Microsoft Windows users with a TXZ archive attachment disguised as an invoice.