SYMBOLCOMMON_NAMEaka. SYNONYMS
win.purelogs (Back to overview)

PureLogs Stealer

aka: zgRAT

According to Netresec, PureLogs is a .NET infostealer developed by PureCoder, who also authors PureRAT, PureMiner and BlueLoader; despite the similar name, it is a separate family from the PureRAT remote access trojan. It automatically collects and exfiltrates credentials and sensitive data from infected hosts, including browser-stored logins, credit card numbers, cookies, crypto-wallet data, VPN credentials and credentials for various chat and messaging platforms. Exfiltration uses a custom binary protocol over configurable but commonly default server ports, and as of version 5.0 that traffic is often wrapped in TLS, which makes it harder to detect on the network. The label zgRAT has been applied both to this family and to PureRAT, and Proofpoint has affirmed that zgRAT should be considered the same malware family as PureLogs rather than as PureRAT; Netresec recommends avoiding the zgRAT label altogether and classifying a sample as unknown PureCoder malware when the specific family is unclear.

References
2026-07-27 ⋅ Netresec ⋅ Erik Hjelmvik
PureLogs, PureRAT and misleading zgRAT
PureLogs Stealer PureRAT
2026-01-19 ⋅ Swiss Post Cybersecurity ⋅ Louis Schürmann
Don't Judge a PNG by Its Header: PURELOGS Infostealer Analysis
PureLogs Stealer
2026-01-13 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update July to December 2025
Coper FluBot Joker Aisuru Mirai AsyncRAT BianLian Cobalt Strike DCRat Havoc Latrodectus PureLogs Stealer Quasar RAT Remcos Rhadamanthys Sliver ValleyRAT Venom RAT Vidar XWorm
2025-12-19 ⋅ cyble ⋅ Cyble
Stealth in Layers: Unmasking the Loader used in Targeted Email Campaigns
DCRat Katz Stealer PhantomVAI PureLogs Stealer Remcos XWorm
2025-11-25 ⋅ Universita Pegaso ⋅ Luigi Martire, Pierluigi Paganini
Dissecting a new malspam chain delivering Purelogs infostealer
PureLogs Stealer
2025-10-18 ⋅ Medium 0xzyadelzyat ⋅ Zyad Elzyat
PureLogs Stealer: Complete Malware Analysis & CTF Walkthrough
PureLogs Stealer
2025-07-02 ⋅ Netresec ⋅ Erik Hjelmvik
PureLogs Forensics
PureLogs Stealer
2025-06-09 ⋅ Netresec ⋅ Erik Hjelmvik
Detecting PureLogs traffic with CapLoader
PureLogs Stealer
2025-03-03 ⋅ DeXpose ⋅ DeXpose
PureLogs Deep Analysis: Evasion, Data Theft, and Encryption Mechanism
PureLogs Stealer
2024-10-28 ⋅ Google ⋅ Google Threat Analysis Group
Hybrid Russian Espionage and Influence Campaign Aims to Compromise Ukrainian Military Recruits and Deliver Anti-Mobilization Narratives
CraxsRAT Pronsis Loader PureLogs Stealer
2024-10-28 ⋅ Google ⋅ Google Threat Analysis Group
Hybrid Russian Espionage and Influence Campaign Aims to Compromise Ukrainian Military Recruits and Deliver Anti-Mobilization Narratives | Google Cloud Blog
CraxsRAT Pronsis Loader PureLogs Stealer
2024-01-16 ⋅ ANY.RUN ⋅ Jane, khr0x, Maksim Mikhailov
A Full Analysis of the Pure Malware Family: Unique and Growing Threat
PureCrypter PureLogs Stealer
2023-12-26 ⋅ Russian Panda Research Blog ⋅ RussianPanda
Pure Logs Stealer Fails to Impress
PureLogs Stealer
2023-02-03 ⋅ Cloudsek ⋅ Deepanjli Paulraj, Pavan Karthick M
Threat Actors Abuse AI-Generated Youtube Videos to Spread Stealer Malware
Alfonso Stealer Bandit Stealer Cameleon Fabookie Lumma Stealer Nanocore RAT Panda Stealer PureLogs Stealer RecordBreaker RedLine Stealer Stealc STOP Vidar
2023-01-16 ⋅ Difesa & Sicurezza ⋅ Francesco Bussoletti
Cybercrime, RFQ from Turkey carries AgentTesla and zgRAT
Agent Tesla PureLogs Stealer
2022-12-27 ⋅ cyble ⋅ Cyble
Pure coder offers multiple malware for sale in Darkweb forums
PureLogs Stealer PureRAT
2022-11-17 ⋅ Trellix ⋅ Trelix
Trellix Insights: SmokeLoader Exploits Old Vulnerabilities to Drop zgRAT
PureLogs Stealer SmokeLoader
2022-08-08 ⋅ Fortinet ⋅ James Slaughter
Life After Death - SmokeLoader Continues to Haunt Using Old Vulnerabilities
PureLogs Stealer SmokeLoader
2021-08-06 ⋅ abuse.ch ⋅ abuse.ch
zgRAT malware samples
PureLogs Stealer

There is no Yara-Signature yet.