Date: 08/19/2026
Severity: High
Summary
This campaign demonstrates how modern stealers increasingly combine social engineering, browser fingerprinting, fileless execution, and steganography to evade traditional detection. Rather than delivering the final malware directly, the attackers progressively reconstruct the payload through process environment variables, PowerShell, RC4 decryption, and PNG iTXt metadata before executing PureLogs Stealer entirely in memory. From a defensive perspective, monitoring registry persistence, headless PowerShell, reflective .NET loading, process environment variable abuse, and outbound connections to staging services such as PixelDrain provides valuable detection opportunities for identifying similar multi-stage .NET malware campaigns.
Indicators of Compromise (IOC) List
Domains/Urls | https://chickplaybox.com https://pixeldrain.com/api/file/rrQHx3jv |
IP Address | 103.107.199.61 |
Hash | a5c3f42c790c5d08897f937899b57c5d357693e89efcc937eb60a582eae50a52
81d05972e09614143db20d2f876e7cd1aaab8297c5fe43c5a97dbb67cd53a510
e2773d0203399dd64798e9f544806661fc280945ceb13d1ba04a5f18cc5e49c8
834a3d5465b04b435498c01d88cda183caf47ed43f622d269d33378504e33335
855a563f42b282c78d414b89d4c662d637c4b0d01bc1ceb43e0cba67c29b63ab
87d7a9a37866b2c31a3dc8f934142765158aef0e6914987115b00b0d42a25d45
424306845f80e9671a6b7c93bffa60b3d0664132e39ffc2de3a487c8158da52e
|
Registry Key | "HKCU\Environment\UserinitMprLogonScript" |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://pixeldrain.com/api/file/rrQHx3jv" or url like "https://pixeldrain.com/api/file/rrQHx3jv" or siteurl like "https://pixeldrain.com/api/file/rrQHx3jv" or domainname like "https://chickplaybox.com" or url like "https://chickplaybox.com" or siteurl like "https://chickplaybox.com" |
Detection Query 2 : | dstipaddress IN ("103.107.199.61") or srcipaddress IN ("103.107.199.61") |
Detection Query 3 : | sha256hash IN ("855a563f42b282c78d414b89d4c662d637c4b0d01bc1ceb43e0cba67c29b63ab","87d7a9a37866b2c31a3dc8f934142765158aef0e6914987115b00b0d42a25d45","834a3d5465b04b435498c01d88cda183caf47ed43f622d269d33378504e33335","81d05972e09614143db20d2f876e7cd1aaab8297c5fe43c5a97dbb67cd53a510","e2773d0203399dd64798e9f544806661fc280945ceb13d1ba04a5f18cc5e49c8","424306845f80e9671a6b7c93bffa60b3d0664132e39ffc2de3a487c8158da52e","a5c3f42c790c5d08897f937899b57c5d357693e89efcc937eb60a582eae50a52")
|
Detection Query 4 : | datasourcename = "Windows Security" and eventtype = "4657" and objectname like "HKCU\Environment\UserinitMprLogonScript" |
Detection Query 5 : | technologygroup = "EDR" and objectname like "HKCU\Environment\UserinitMprLogonScript" |
Reference:
https://gurucul.com/blog/analyzing-purelogs-stealer-fake-adobe-sign-phishing-uses-png-steganography-and-fileless-execution/