{"id":6639,"date":"2024-01-16T05:45:36","date_gmt":"2024-01-16T05:45:36","guid":{"rendered":"\/cybersecurity-blog\/?p=6639"},"modified":"2026-02-10T13:47:18","modified_gmt":"2026-02-10T13:47:18","slug":"pure-malware-family-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/pure-malware-family-analysis\/","title":{"rendered":"A Full Analysis of the Pure Malware Family: Unique and Growing Threat"},"content":{"rendered":"\n

In this article, we\u2019re analyzing one of the most unusual crypters\u2014 PureCrypter<\/strong>, and a multifunctional stealer \u2014 PureLogs<\/strong>. We’ll look at several examples and identify patterns among Pure-malware families, and also explain how to detect PureCrypter and PureLogs. <\/p>\n\n\n\n

Why did we decide to undertake this analysis?<\/strong> <\/h2>\n\n\n\n

While analyzing Public Submissions, we came across several interesting samples. We were intrigued by unusual traffic that showed signs of encryption operations on executable files with short keys, as well as TCP connections with high entropy in the connections. <\/p>\n\n\n\n

Inside, all samples looked different from other malware and were very similar to each other. Through network analysis, we found a couple of articles dedicated to PureCrypter and the family, which shed light on this group, but we wanted to add our insights and combine all the information in one place. <\/p>\n\n\n\n

Our objectives were: <\/p>\n\n\n\n