Affected Platforms: Microsoft Windows
Impacted Users: Any organization
Impact: Attackers Stolen data may be leveraged for follow-on attacks
Severity Level: High

The use of steganography in the threat landscape continues to accelerate. Threat actors are increasingly shifting from direct encrypted transfers to a 'legitimate-file-plus-hidden-data' model, effectively masking their next-stage payloads within everyday media.

FortiGuard Labs recently uncovered a phishing campaign that abuses environment variables to hide malicious commands and uses PawsRunner as a Steganography Loader to deploy the .NET infostealer PureLogs.

Initial Access

The attack campaign begins with a phishing email containing an TXZ archive (an XZ-compressed TAR file) as an attachment, as illustrated in Figure 2. It uses an invoice-themed lure and a sense of urgency to prompt the recipient to open the attachment without delay.

JavaScript

The JavaScript file extracted from the archive contains several functions, each preceded by irrelevant comments. These comments are in a mix of languages, including Chinese, Japanese, Korean, Russian, Hindi, and Arabic, as shown in Figure 3.

.NET Assembly Loader

The .Net assembly will decrypt and load the next stage, which is also an executable file.

Furthermore, when issuing the download request, the loader specifies a hierarchical preference in the Accept header. It prioritizes image/png, then image/*, and finally */*, explicitly requesting the server to return a PNG image as the preferred response type if available.

The downloaded data may contain three types of content: HTML, Base64-encoded data, and a PNG file. It is processed accordingly based on its type.

• For HTML content, a new URL is extracted from the HTML, the original download link is replaced with it, and the data is then attempted to be downloaded from the updated URL.
• Base64-encoded data is first decoded. The decoded data and the PNG file are then processed in the same way: the image file uses steganography to conceal data within the picture and uses “iTXt” and “IEND” chunks as markers to locate the encrypted data. This data is then used to decrypt the next stage of the payload. Interestingly, the PNG files we have downloaded also include images of cats.

After decoding the PNG file, we obtained another .NET execution file.

However, the loader also provides a fallback mechanism. If the download fails or the payload cannot be extracted from the downloaded data, it will use an alternate set of URLs from the configuration as a fallback. In the sample we’ve analyzed, the fallback URLs are empty.

After bypassing ETW and Windows 11 (24H2) security features, the next-stage payload is executed.

We have been tracking similar loaders since March of this year and have observed several evolutions. Initially, the loader simply downloaded and executed a PE file. It later transitioned to extracting an encrypted payload from image files using steganography.

Furthermore, a version discovered in early April included a persistence module. Notably, the initial versions lacked a fallback URL mechanism. However, since the beginning, the loader has consistently attempted to download data using various Network APIs, and the decrypted EXE loader has consistently used cat photos for its application icon.

The next section provides a detailed examination of 'Purelogs,' the final-stage payload delivered by PawsRunner.

PureLogs

PureLogs is an infostealer from the Pure family of products developed by PureCoder. As the most prominent member of the Pure family’s malware, it uses .NET Reactor for protection and employs Protobuf serialization for its configuration data.

In this attack campaign, the executable first loads a resource-only assembly that contains no executable code, only resource data. It then decrypts and decompresses the resource data as a .NET DLL using TripleDES and Gunzip, as shown in Figure 14.

The downloaded encrypted payload must be decrypted with AES-256 in CBC mode, using the key specified in the configuration. After decryption and decompression with gzip, the PureLogs core DLL is loaded into memory, and its entry point is invoked.

PureLogs retrieves its configuration from parameters passed during invocation. Consistent with the previous layer, this component performs a connectivity test before initiating the collection routine. It first collects the victim information as detailed below and reports it to the C&C server via an HTTP request. It then gathers victim system information—as detailed below—and exfiltrates it to the C2 server via HTTP requests. This stage leverages Windows Management Instrumentation (WMI) to profile the victim's system environment. Based on the configuration, the version appears to be 5.0.0.

The following is a list of harvested items:

Web browsers:

Google Chrome, Chrome Beta, Chrome SxS, Chrome Dev, Chrome Unstable, Chrome Canary, Chromium, Microsoft Edge, Brave, Epic Privacy Browser, Amigo, Vivaldi, Kometa, Orbitum, Mail.Ru Atom, Comodo Dragon, Torch, Comodo, 360 Chrome, Slimjet, Maxthon, QQ Browser, K-Meleon, Xpom, Lenovo SLBrowser, Xvast, Go!, Safer Secure Browser, Sputnik, Nichrome, CocCoc, Uran, Chromodo, 7Star, Chedot, CentBrowser, Iridium, Elements Browser, Citrio, Sleipnir, QIP Surf, Liebao, Coowon, ChromePlus, Rafotech Mustang, Suhba, TorBro, RockMelt, Bromium, Twinkstar, iTop Private Browser, CCleaner Browser, AcWebBrowser, CoolNovo, Baidu Spark, SRWare Iron, Titan Browser, AVAST Browser, AVG Browser, UC Browser, UR Browser, Blisk, Flock, CryptoTab, Sidekick, SwingBrowser, Superbird, SalamWeb, GhostBrowser, NetboxBrowser, GarenaPlus, Kinza, InsomniacBrowser, ViaSat, Naver Whale, Falkon, Sogou Explorer, Opera Stable, Opera GX, Opera Neon, Opera Crypto Developer, Yandex Browser, Firefox, SeaMonkey, Waterfox, K-Meleon, Thunderbird, IceDragon, Cyberfox, BlackHawk, Pale Moon, Basilisk, BitTube, SlimBrowser, LibreWolf, Mercury.

Extensions: (crypto wallets, password managers, and authenticators)

Wallet applications:

Qtum, Ethereum, Bitcoin, Dogecoin, Monero, DashCore, Litecoin, Bytecoin, Coinomi, Armory, MultiBit, Exodus, Electrum, Electrum-LTC, Atomic, Guarda, BitPay, Wasabi, ElectronCash, Sparrow, IOCoin, PPCoin, BBQCoin, Mincoin, DevCoin, YACoin, Franko, FreiCoin, InfiniteCoin, GoldCoin, Binance, Terracoin, Daedalus Mainnet, MyMonero, MyCrypto, Bisq, Zap, Simpleos, Neon, bitmonero, Etherwall.

Communication applications:

Discord, DiscordCanary, DiscordPTB, DiscordDevelopment, Lightcord, Telegram, Signal, Pidgin.

Others:

Steam, OpenVpn, PhontanVPN, Ngrok, OBS Studio, FileZilla, WinSCP, FoxMail, MailBird, MailMaster, Outlook.

For C2 communication, instead of using sockets like the previous version, it uses HTTP requests with different endpoints for each action, including /ping, /plugin, /userinfo, /browser, /application, /crypto, /discord, /filesearch/req, /filesearch/res, and /finish.

As shown in Figure 19, PureLogs transmitted the harvested data through multiple requests, using specified URLs and the POST method based on the type of collected data. All transmitted data was encrypted with AES and compressed with Gzip.

Conclusion

Don't let seemingly harmless media files fool you. Increasingly, malware uses steganography to hide within these files. From strange bitmaps to cute cat pictures, everyday images are being weaponized to secretly transmit encrypted malicious code across networks without raising suspicion.

In this article, we uncovered an attack campaign involving a new steganography loader, PawsRunner, to deliver the well-known .NET infostealer, PureLogs. The infection chain begins with a phishing email that delivers a TXZ archive. The embedded JavaScript uses a sophisticated technique to store decoded malicious commands in environment variables, which then triggers a decrypted steganographic .NET loader. This loader retrieves the final payload by extracting encrypted data hidden within a cat image. This version of PureLogs uses extensive async/await patterns to improve task efficiency and complicate analysis. Additionally, it uses HTTPS for its Command and Control (C2) communications.

Fortinet Protections

The malware described in this report are detected and blocked by FortiGuard Antivirus as:

EML/Phishing.973A!tr
JS/Formbook.VEN!tr
MSIL/Agent.6942!tr
MSIL/WSA!tr
MSIL/Kryptik.AQAJ!tr
MSIL/WOF!tr

FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard Antivirus Service. The FortiGuard antivirus engine is included in each of those solutions. As a result, customers with these products and up-to-date protections are protected, and customers can enforce the blocking of the unusual TXZ file format.

The FortiGuard CDR (content disarm and reconstruction) service can disarm malicious macros within the document.

FortiGuard Labs provides the Purelogs.Botnet IPS signature to block communications with the PureLogs C2 network.

We also suggest that organizations take the free Fortinet Certified Fundamentals (FCF) cybersecurity training. The training is designed to help users understand today's threat landscape and to introduce basic cybersecurity concepts and technology.

FortiGuard IP Reputation and the Anti-Botnet Security Service proactively block malware attacks by aggregating malicious source IP data from the Fortinet distributed network of threat sensors, CERTs, MITRE, cooperative competitors, and other global sources that collaborate to provide up-to-date threat intelligence on hostile sources.

If you believe this or any other cybersecurity threat has affected your organization, please contact the Global FortiGuard Incident Response Team.

IOCs

C2:

5[.]101[.]84[.]202

URLs:

hxxps://everycarebd[.]com/imagelkjh0987[.]png

SHA256:

8d0bcde739929fe41a6bcaaa62f7cba802af90b2ba8dea6ed1a4821236cdd588
6910d27b9e1dc2229a8c280f5d0cea85146d50274c56a4d9a5b8d1793505b1b9
93724f1a9ad3a28c171927fc449ac34dc6ca890f915f00210e8b305577388c6e
0fcb86ae384e9975933314ac2a231f0ff46c0208556bf4a16f096a642d3f505e
1b730de72f921458b6b162b105a9521a931f07e19d3cac53207c7a8efbc412f9
e2308749f6b7b7573009d0cac6616a6aa83cecb1f2933e868776400d122c86ec