Most commodity stealers are boring. You unpack them, log the C2, write the rule, and move on. This one earned a second look — not because PureLogs is novel, but because of where its infrastructure trail ended up.
Pivoting from a single .NET payload through the sample's relationship graph, the delivery chain resolved to everycarebd[.]com — a domain answering on 103[.]112[.]62[.]142, an IP geolocated in Bangladesh. The Bangladeshi asset was not the victim here. It was part of the machine.
The stealer is imported. The staging ground is local.
That is the part worth sitting with. When infrastructure inside the country is folded into a foreign crimeware operation, every packet it serves is attributable to a Bangladeshi netblock — and every defender abroad who blocks it is, in effect, blocking us. Below is the whole chain, start to finish.
The sample at a glance
PureLogs is a .NET information stealer from the wider “Pure” malware-as-a-service family (PureCrypter, PureLogs, PureHVNC, PureMiner). It is sold cheaply, obfuscated heavily, and configured per-campaign. This build profiles the host, runs an aggressive anti-analysis gate, then steals browser data, crypto wallets, and Discord tokens — with a generic file grabber and a plugin loader for whatever the operator wants to bolt on later.
Delivery: the everycarebd[.]com stager
The campaign domain everycarebd[.]com resolves to two addresses: 103[.]112[.]62[.]142 in Bangladesh — the primary staging host — and 15[.]197[.]240[.]20 in the US, a secondary/CDN-fronted resolution. The Bangladeshi node is the one doing the work.
The domain is a full delivery platform, not a single dropper. It hosts more than 60 payload URLs and communicates with a broad artifact set: 18 PE executables, 13 RAR archives, 11 JavaScript files, 8 VBA maldocs, 2 PowerShell scripts, plus email, XLS and CSV lures. That is the signature of a phishing-led operation that fans out across file types to defeat single-format detection.
The link to the stealer is not circumstantial. A single detected phishing email — 0368a3ba3cf519db81da83aa220bb2ecf4067ce744e33de1e77ec16440b92b37 — is simultaneously a delivery parent of the PureLogs payload and a file communicating with everycarebd[.]com. That one node stitches the lure, the staging domain, and the final stealer into the same campaign.
Execution: a loader chain nested in resources
Once a loader lands on the host, the stealer unpacks itself through three stages, each hidden inside the previous one's resource section:
- The first-stage loader (
…_Slayed.exe) loads0.dlland decrypts the obfuscated string hashtable from its embedded resources. 0.dllis a pure resource container — no logic, just the encrypted string table the next stage needs.- The decrypted table lets it load the main payload,
1.dll(assemblyCubfnbw, 672 name-mangled types). From its own resources,1.dllthen decodes the protobuf config, loads the string tables, and decrypts and side-loads a private copy ofprotobuf-net.dllfor serialization.
The config itself is a base64-wrapped protobuf blob. Decoded, it hands over the operator's settings cleanly: C2 80[.]66[.]84[.]164 on port 1234, campaign ID aeffec61f169, tag gogetit, and a 32-byte pre-shared key that protects the C2 traffic. Requests authenticate with a fixed X-Api-Key: PbOvYebPzfoA header.
What it steals
Capabilities map directly to the C2 endpoint set recovered from the payload:
/browser— saved passwords, cookies, autofill and card data from Chromium- and Gecko-based browsers./cryptoand/discord— cryptocurrency wallet files and Discord tokens./filesearch— a server-driven file grabber: the C2 pushes search criteria and the implant returns matches./plugin— downloads and runs additional modules in memory, which is how a stealer today becomes a clipper, HVNC, or miner tomorrow./chunk/start|data|end— chunked upload for bulk exfiltration of large archives, plus screen capture via System.Drawing.
The evasion gate
Before any of that runs, PureLogs checks whether it is being watched — and the check-set is unusually broad. It queries WMI for BIOS, baseboard and system manufacturer strings; matches MAC OUI prefixes for VMware, VirtualBox, Hyper-V, Parallels and QEMU; inspects registry keys, guest-tool driver files and running processes for VirtualBox, VMware, Xen and QEMU; hunts for analysis tools (Wireshark, Procmon, x64dbg, IDA, Fiddler) and sandbox tells (sbiedll.dll, cuckoomon.dll, and paths like C:\cuckoo or C:\sandbox). If any fire, it quietly exits before touching the network — which is exactly why dynamic confirmation has to happen on a hardened VM.
Why this one matters for Bangladesh
Commodity stealers rarely make local headlines because the code is foreign and the victims are everywhere. But staging infrastructure is territorial. A domain resolving to a Bangladeshi IP, serving dozens of malicious payloads, means a locally-hosted asset — very possibly a compromised legitimate site — is now underwriting a foreign crimeware campaign. If it is not cleaned up, three things follow: the netblock's reputation degrades, defenders abroad start blanket-blocking ranges that legitimate Bangladeshi services also live in, and the operators get a stable, low-suspicion home base to stage from.
The action items are concrete: hosting providers on this netblock should audit everycarebd[.]com and adjacent accounts; local SOCs should block the C2 and the staging IP and hunt for the endpoint paths below; and anyone who owns the legitimate brand behind that domain should treat it as compromised until proven otherwise.
Indicators of compromise
Network
Staging domain: everycarebd[.]com
IP (staging, BD): 103[.]112[.]62[.]142
IP (secondary, US): 15[.]197[.]240[.]20
C2: 80[.]66[.]84[.]164:1234
HTTP header: X-Api-Key: PbOvYebPzfoA
C2 URI paths: /ping /userinfo /browser /crypto /discord /application /plugin /filesearch /chunk/start /chunk/data /chunk/end /finish
Files — SHA-256
Loader payload: 899b268e756f5158f6707e76e15e0af4ab9a6a09953274ee1b549666f3cf2f12
Phishing email (delivery pivot): 0368a3ba3cf519db81da83aa220bb2ecf4067ce744e33de1e77ec16440b92b37
Config / campaign
Campaign ID: aeffec61f169
Tag: gogetit
Assembly: Cubfnbw
Embedded SSL Verification Key: c280e2c993e1f62ab3cb9b753a186483b9f059a389a78c3def0e37e8a391067f
Detection and response
The most durable signatures are the fixed API-key header and the full C2 path set — both survive an IP rotation. Hunt for .NET processes that fire a burst of WMI hardware queries and then immediately beacon out; that anti-VM-then-callout pattern is characteristic. Pivot on the campaign tag gogetit and the API key to surface sibling samples. And treat any host that reached /userinfo as credential-compromised: rotate browser-stored passwords, session cookies, Discord tokens, and any wallet seed exposed on disk.