#purerat β Public Fediverse posts
Live and recent posts from across the Fediverse tagged #purerat, aggregated by home.social.
-
zgRAT is a confusing catch-all label: both #PureLogs and #PureRAT commonly trigger "zgRAT" detections. Please don't label malware as #zgRAT.
https://netresec.com/?b=267e877 -
zgRAT is a confusing catch-all label: both #PureLogs and #PureRAT commonly trigger "zgRAT" detections. Please don't label malware as #zgRAT.
https://netresec.com/?b=267e877 -
zgRAT is a confusing catch-all label: both #PureLogs and #PureRAT commonly trigger "zgRAT" detections. Please don't label malware as #zgRAT.
https://netresec.com/?b=267e877 -
zgRAT is a confusing catch-all label: both #PureLogs and #PureRAT commonly trigger "zgRAT" detections. Please don't label malware as #zgRAT.
https://netresec.com/?b=267e877 -
zgRAT is a confusing catch-all label: both #PureLogs and #PureRAT commonly trigger "zgRAT" detections. Please don't label malware as #zgRAT.
https://netresec.com/?b=267e877 -
@james_inthe_box @da_667 FlowCarp classifies
104.249.10.71:2555as #PureRAT inside of TLS.Feel free to verify with:
curl -s --data-binary @4bd07f35-3a29-477a-8e2b-7e4d31182cd7.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]' -
@james_inthe_box @da_667 FlowCarp classifies
104.249.10.71:2555as #PureRAT inside of TLS.Feel free to verify with:
curl -s --data-binary @4bd07f35-3a29-477a-8e2b-7e4d31182cd7.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]' -
@james_inthe_box @da_667 FlowCarp classifies
104.249.10.71:2555as #PureRAT inside of TLS.Feel free to verify with:
curl -s --data-binary @4bd07f35-3a29-477a-8e2b-7e4d31182cd7.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]' -
@james_inthe_box @da_667 FlowCarp classifies
104.249.10.71:2555as #PureRAT inside of TLS.Feel free to verify with:
curl -s --data-binary @4bd07f35-3a29-477a-8e2b-7e4d31182cd7.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]' -
@james_inthe_box @da_667 FlowCarp classifies
104.249.10.71:2555as #PureRAT inside of TLS.Feel free to verify with:
curl -s --data-binary @4bd07f35-3a29-477a-8e2b-7e4d31182cd7.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]' -
PureRAT: Attacker Now Using AI to Build Toolset
#PureRAT
https://www.security.com/threat-intelligence/ai-purerat-phishing -
PureRAT: Attacker Now Using AI to Build Toolset
#PureRAT
https://www.security.com/threat-intelligence/ai-purerat-phishing -
PureRAT: Attacker Now Using AI to Build Toolset
#PureRAT
https://www.security.com/threat-intelligence/ai-purerat-phishing -
PureRAT: Attacker Now Using AI to Build Toolset
#PureRAT
https://www.security.com/threat-intelligence/ai-purerat-phishing -
PureRAT: Attacker Now Using AI to Build Toolset
#PureRAT
https://www.security.com/threat-intelligence/ai-purerat-phishing -
@malware_traffic Thank you for sharing Brad!
The TLS traffic to173.232.146.62:25658looks like #AsyncRAT or possibly #PureRAT. Can you confirm if it was generated by the powershell script with MD590389d2988cce2fe508087618dd2f519fromfnjnbehjangelkd[.]top? -
@malware_traffic Thank you for sharing Brad!
The TLS traffic to173.232.146.62:25658looks like #AsyncRAT or possibly #PureRAT. Can you confirm if it was generated by the powershell script with MD590389d2988cce2fe508087618dd2f519fromfnjnbehjangelkd[.]top? -
@malware_traffic Thank you for sharing Brad!
The TLS traffic to173.232.146.62:25658looks like #AsyncRAT or possibly #PureRAT. Can you confirm if it was generated by the powershell script with MD590389d2988cce2fe508087618dd2f519fromfnjnbehjangelkd[.]top? -
@malware_traffic Thank you for sharing Brad!
The TLS traffic to173.232.146.62:25658looks like #AsyncRAT or possibly #PureRAT. Can you confirm if it was generated by the powershell script with MD590389d2988cce2fe508087618dd2f519fromfnjnbehjangelkd[.]top? -
@malware_traffic Thank you for sharing Brad!
The TLS traffic to173.232.146.62:25658looks like #AsyncRAT or possibly #PureRAT. Can you confirm if it was generated by the powershell script with MD590389d2988cce2fe508087618dd2f519fromfnjnbehjangelkd[.]top? -
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
Mentioned Malware Families: ValleyRAT, PureRAT
Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_ratAliases provided by Malpedia.
-
RE: https://infosec.exchange/@VirusBulletin/115660902138702248
How is this #ValleyRAT? It looks, swims and quacks like #PureRAT.
Here are some typical PureRAT indicators:
:windows: .NET malware
π TLS version is 1.0
π« JA3fc54e0d16d9764783542f0146a98b300/07af4aa9e4d215a5ee63f9a0a277fbe3
π« JA4t10i070500_c50f5591e341_950472255fe9/t10i060500_4dc025c38c38_950472255fe9
π« JA3Sb74704234e6128f33bff9865696e31b3
π X.509 cert expires 9999-12-31 23:59:59 UTC
π‘ C2 often runs on TCP 56001
All of them match on the sample analyzed in Trend's report -
RE: https://infosec.exchange/@VirusBulletin/115660902138702248
How is this #ValleyRAT? It looks, swims and quacks like #PureRAT.
Here are some typical PureRAT indicators:
:windows: .NET malware
π TLS version is 1.0
π« JA3fc54e0d16d9764783542f0146a98b300/07af4aa9e4d215a5ee63f9a0a277fbe3
π« JA4t10i070500_c50f5591e341_950472255fe9/t10i060500_4dc025c38c38_950472255fe9
π« JA3Sb74704234e6128f33bff9865696e31b3
π X.509 cert expires 9999-12-31 23:59:59 UTC
π‘ C2 often runs on TCP 56001
All of them match on the sample analyzed in Trend's report -
RE: https://infosec.exchange/@VirusBulletin/115660902138702248
How is this #ValleyRAT? It looks, swims and quacks like #PureRAT.
Here are some typical PureRAT indicators:
:windows: .NET malware
π TLS version is 1.0
π« JA3fc54e0d16d9764783542f0146a98b300/07af4aa9e4d215a5ee63f9a0a277fbe3
π« JA4t10i070500_c50f5591e341_950472255fe9/t10i060500_4dc025c38c38_950472255fe9
π« JA3Sb74704234e6128f33bff9865696e31b3
π X.509 cert expires 9999-12-31 23:59:59 UTC
π‘ C2 often runs on TCP 56001
All of them match on the sample analyzed in Trend's report -
RE: https://infosec.exchange/@VirusBulletin/115660902138702248
How is this #ValleyRAT? It looks, swims and quacks like #PureRAT.
Here are some typical PureRAT indicators:
:windows: .NET malware
π TLS version is 1.0
π« JA3fc54e0d16d9764783542f0146a98b300/07af4aa9e4d215a5ee63f9a0a277fbe3
π« JA4t10i070500_c50f5591e341_950472255fe9/t10i060500_4dc025c38c38_950472255fe9
π« JA3Sb74704234e6128f33bff9865696e31b3
π X.509 cert expires 9999-12-31 23:59:59 UTC
π‘ C2 often runs on TCP 56001
All of them match on the sample analyzed in Trend's report -
RE: https://infosec.exchange/@VirusBulletin/115660902138702248
How is this #ValleyRAT? It looks, swims and quacks like #PureRAT.
Here are some typical PureRAT indicators:
:windows: .NET malware
π TLS version is 1.0
π« JA3fc54e0d16d9764783542f0146a98b300/07af4aa9e4d215a5ee63f9a0a277fbe3
π« JA4t10i070500_c50f5591e341_950472255fe9/t10i060500_4dc025c38c38_950472255fe9
π« JA3Sb74704234e6128f33bff9865696e31b3
π X.509 cert expires 9999-12-31 23:59:59 UTC
π‘ C2 often runs on TCP 56001
All of them match on the sample analyzed in Trend's report -
βI Paid Twiceβ Scam Infects Booking.com Users with PureRAT via ClickFix https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/ #ScamsandFraud #Cybersecurity #CyberAttack #ResolverRAT #Bookingcom #PureCoder #Security #PureHVNC #Malware #Expedia #Privacy #PureRAT #Sekoia #Travel #Hotel
-
βI Paid Twiceβ Scam Infects Booking.com Users with PureRAT via ClickFix https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/ #ScamsandFraud #Cybersecurity #CyberAttack #ResolverRAT #Bookingcom #PureCoder #Security #PureHVNC #Malware #Expedia #Privacy #PureRAT #Sekoia #Travel #Hotel
-
βI Paid Twiceβ Scam Infects Booking.com Users with PureRAT via ClickFix https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/ #ScamsandFraud #Cybersecurity #CyberAttack #ResolverRAT #Bookingcom #PureCoder #Security #PureHVNC #Malware #Expedia #Privacy #PureRAT #Sekoia #Travel #Hotel
-
βI Paid Twiceβ Scam Infects Booking.com Users with PureRAT via ClickFix https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/ #ScamsandFraud #Cybersecurity #CyberAttack #ResolverRAT #Bookingcom #PureCoder #Security #PureHVNC #Malware #Expedia #Privacy #PureRAT #Sekoia #Travel #Hotel
-
π New and ongoing βI Paid Twiceβ scam hits hotels and guests using #PureRAT via ClickFix attack. Attackers breach booking accounts like #Booking.com, then message travelers about fake payment issues to steal bank info.
Read π https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/
-
π New and ongoing βI Paid Twiceβ scam hits hotels and guests using #PureRAT via ClickFix attack. Attackers breach booking accounts like #Booking.com, then message travelers about fake payment issues to steal bank info.
Read π https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/
-
π New and ongoing βI Paid Twiceβ scam hits hotels and guests using #PureRAT via ClickFix attack. Attackers breach booking accounts like #Booking.com, then message travelers about fake payment issues to steal bank info.
Read π https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/
-
π New and ongoing βI Paid Twiceβ scam hits hotels and guests using #PureRAT via ClickFix attack. Attackers breach booking accounts like #Booking.com, then message travelers about fake payment issues to steal bank info.
Read π https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/
-
The technical detail in this PureRAT analysis by Heejae Hwang (ν©ν¬μ¬) is fantastic! The analyzed #PureRAT sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.
-
The technical detail in this PureRAT analysis by Heejae Hwang (ν©ν¬μ¬) is fantastic! The analyzed #PureRAT sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.
-
The technical detail in this PureRAT analysis by Heejae Hwang (ν©ν¬μ¬) is fantastic! The analyzed #PureRAT sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.
-
The technical detail in this PureRAT analysis by Heejae Hwang (ν©ν¬μ¬) is fantastic! The analyzed #PureRAT sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.
-
The technical detail in this PureRAT analysis by Heejae Hwang (ν©ν¬μ¬) is fantastic! The analyzed #PureRAT sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.
-
Phishing emails that look legit and hidden DLLs are paving the way for a new breed of cyber threats. How did attackers upgrade from a simple infostealer to a full-blown RAT? Dive into the evolution of PureRAT to find out.
https://thedefendopsdiaries.com/dissecting-the-purerat-attack-chain-from-infostealer-to-full-rat/
#purerat
#cyberattack
#dllsideloading
#remotetrojan
#defenseevasion -
Phishing emails that look legit and hidden DLLs are paving the way for a new breed of cyber threats. How did attackers upgrade from a simple infostealer to a full-blown RAT? Dive into the evolution of PureRAT to find out.
https://thedefendopsdiaries.com/dissecting-the-purerat-attack-chain-from-infostealer-to-full-rat/
#purerat
#cyberattack
#dllsideloading
#remotetrojan
#defenseevasion -
Phishing emails that look legit and hidden DLLs are paving the way for a new breed of cyber threats. How did attackers upgrade from a simple infostealer to a full-blown RAT? Dive into the evolution of PureRAT to find out.
https://thedefendopsdiaries.com/dissecting-the-purerat-attack-chain-from-infostealer-to-full-rat/
#purerat
#cyberattack
#dllsideloading
#remotetrojan
#defenseevasion -
Phishing emails that look legit and hidden DLLs are paving the way for a new breed of cyber threats. How did attackers upgrade from a simple infostealer to a full-blown RAT? Dive into the evolution of PureRAT to find out.
https://thedefendopsdiaries.com/dissecting-the-purerat-attack-chain-from-infostealer-to-full-rat/
#purerat
#cyberattack
#dllsideloading
#remotetrojan
#defenseevasion -
@BleepingComputer More info about these #ResolverRAT #PureRAT indicators can be found here:
https://netresec.com/?b=2589522
