#purerat — Public Fediverse posts

zgRAT is a confusing catch-all label: both #PureLogs and #PureRAT commonly trigger "zgRAT" detections. Please don't label malware as #zgRAT.
https://netresec.com/?b=267e877

zgRAT is a confusing catch-all label: both #PureLogs and #PureRAT commonly trigger "zgRAT" detections. Please don't label malware as #zgRAT.
https://netresec.com/?b=267e877

@james_inthe_box @da_667 FlowCarp classifies 104.249.10.71:2555 as #PureRAT inside of TLS.

Feel free to verify with:
curl -s --data-binary @4bd07f35-3a29-477a-8e2b-7e4d31182cd7.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]'

@james_inthe_box @da_667 FlowCarp classifies 104.249.10.71:2555 as #PureRAT inside of TLS.

Feel free to verify with:
curl -s --data-binary @4bd07f35-3a29-477a-8e2b-7e4d31182cd7.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]'

Fresh #purerat :

https://app.any.run/tasks/4bd07f35-3a29-477a-8e2b-7e4d31182cd7

cc @da_667

Fresh #purerat :

https://app.any.run/tasks/4bd07f35-3a29-477a-8e2b-7e4d31182cd7

cc @da_667

PureRAT: Attacker Now Using AI to Build Toolset
#PureRAT
https://www.security.com/threat-intelligence/ai-purerat-phishing

PureRAT: Attacker Now Using AI to Build Toolset
#PureRAT
https://www.security.com/threat-intelligence/ai-purerat-phishing

@malware_traffic Thank you for sharing Brad!
The TLS traffic to 173.232.146.62:25658 looks like #AsyncRAT or possibly #PureRAT. Can you confirm if it was generated by the powershell script with MD5 90389d2988cce2fe508087618dd2f519 from fnjnbehjangelkd[.]top?

@malware_traffic Thank you for sharing Brad!
The TLS traffic to 173.232.146.62:25658 looks like #AsyncRAT or possibly #PureRAT. Can you confirm if it was generated by the powershell script with MD5 90389d2988cce2fe508087618dd2f519 from fnjnbehjangelkd[.]top?

Mentioned Malware Families: ValleyRAT, PureRAT

Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_rat

#ValleyRAT #PureRAT

Aliases provided by Malpedia.

Mentioned Malware Families: ValleyRAT, PureRAT

Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_rat

#ValleyRAT #PureRAT

Aliases provided by Malpedia.

Mentioned Malware Families: ValleyRAT, PureRAT

Aliases for ValleyRAT: win.valley_rat, Winos
Malpedia link for ValleyRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat
Aliases for PureRAT: win.pure_rat, PureHVNC, ResolverRAT
Malpedia link for PureRAT: https://malpedia.caad.fkie.fraunhofer.de/details/win.pure_rat

#ValleyRAT #PureRAT

Aliases provided by Malpedia.

RE: https://infosec.exchange/@VirusBulletin/115660902138702248

How is this #ValleyRAT? It looks, swims and quacks like #PureRAT.
Here are some typical PureRAT indicators:
:windows: .NET malware
🔑 TLS version is 1.0
🫆 JA3 fc54e0d16d9764783542f0146a98b300 / 07af4aa9e4d215a5ee63f9a0a277fbe3
🫆 JA4 t10i070500_c50f5591e341_950472255fe9 / t10i060500_4dc025c38c38_950472255fe9
🫆 JA3S b74704234e6128f33bff9865696e31b3
📝 X.509 cert expires 9999-12-31 23:59:59 UTC
📡 C2 often runs on TCP 56001
All of them match on the sample analyzed in Trend's report

RE: https://infosec.exchange/@VirusBulletin/115660902138702248

How is this #ValleyRAT? It looks, swims and quacks like #PureRAT.
Here are some typical PureRAT indicators:
:windows: .NET malware
🔑 TLS version is 1.0
🫆 JA3 fc54e0d16d9764783542f0146a98b300 / 07af4aa9e4d215a5ee63f9a0a277fbe3
🫆 JA4 t10i070500_c50f5591e341_950472255fe9 / t10i060500_4dc025c38c38_950472255fe9
🫆 JA3S b74704234e6128f33bff9865696e31b3
📝 X.509 cert expires 9999-12-31 23:59:59 UTC
📡 C2 often runs on TCP 56001
All of them match on the sample analyzed in Trend's report

“I Paid Twice” Scam Infects Booking.com Users with PureRAT via ClickFix https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/ #ScamsandFraud #Cybersecurity #CyberAttack #ResolverRAT #Bookingcom #PureCoder #Security #PureHVNC #Malware #Expedia #Privacy #PureRAT #Sekoia #Travel #Hotel

“I Paid Twice” Scam Infects Booking.com Users with PureRAT via ClickFix https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/ #ScamsandFraud #Cybersecurity #CyberAttack #ResolverRAT #Bookingcom #PureCoder #Security #PureHVNC #Malware #Expedia #Privacy #PureRAT #Sekoia #Travel #Hotel

🛑 New and ongoing “I Paid Twice” scam hits hotels and guests using #PureRAT via ClickFix attack. Attackers breach booking accounts like #Booking.com, then message travelers about fake payment issues to steal bank info.

Read 🔗 https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/

#Cybersecurity #HotelFraud #Malware #Phishing #ClickFix

🛑 New and ongoing “I Paid Twice” scam hits hotels and guests using #PureRAT via ClickFix attack. Attackers breach booking accounts like #Booking.com, then message travelers about fake payment issues to steal bank info.

Read 🔗 https://hackread.com/i-paid-twice-scam-booking-com-purerat-clickfix/

#Cybersecurity #HotelFraud #Malware #Phishing #ClickFix

The technical detail in this PureRAT analysis by Heejae Hwang (황희재) is fantastic! The analyzed #PureRAT sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.

The technical detail in this PureRAT analysis by Heejae Hwang (황희재) is fantastic! The analyzed #PureRAT sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.

Phishing emails that look legit and hidden DLLs are paving the way for a new breed of cyber threats. How did attackers upgrade from a simple infostealer to a full-blown RAT? Dive into the evolution of PureRAT to find out.

https://thedefendopsdiaries.com/dissecting-the-purerat-attack-chain-from-infostealer-to-full-rat/

#purerat
#cyberattack
#dllsideloading
#remotetrojan
#defenseevasion

Phishing emails that look legit and hidden DLLs are paving the way for a new breed of cyber threats. How did attackers upgrade from a simple infostealer to a full-blown RAT? Dive into the evolution of PureRAT to find out.

https://thedefendopsdiaries.com/dissecting-the-purerat-attack-chain-from-infostealer-to-full-rat/

#purerat
#cyberattack
#dllsideloading
#remotetrojan
#defenseevasion

@BleepingComputer More info about these #ResolverRAT #PureRAT indicators can be found here:
https://netresec.com/?b=2589522

@BleepingComputer More info about these #ResolverRAT #PureRAT indicators can be found here:
https://netresec.com/?b=2589522

@BleepingComputer Transcript of the TCP sessions to 45.144.53.137:57666 reveal several #ResolverRAT / #PureRAT indicators.

@BleepingComputer Transcript of the TCP sessions to 45.144.53.137:57666 reveal several #ResolverRAT / #PureRAT indicators.

@BleepingComputer It then drops #PureRAT aka #ResolverRAT on the victim's PC.

@BleepingComputer It then drops #PureRAT aka #ResolverRAT on the victim's PC.

PureRAT = ResolverRAT = PureHVNC – Source: securityboulevard.com https://ciso2ciso.com/purerat-resolverrat-purehvnc-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #PureCoder’s #ResolverRat #9999-12-31 #PureHVNC #PureRAT #56001 #56002 #56003

PureRAT = ResolverRAT = PureHVNC – Source: securityboulevard.com https://ciso2ciso.com/purerat-resolverrat-purehvnc-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #PureCoder’s #ResolverRat #9999-12-31 #PureHVNC #PureRAT #56001 #56002 #56003

PureRAT is the exact same malware as what Morphisec and others call #ResolverRAT. #PureHVNC, on the other hand, is the predecessor to #PureRAT.

IOCs:
👾 193.26.115.125:8883
👾 purebase.ddns[.]net:8883
👾 45.74.10.38:56001
👾 139.99.83.25:56001
https://netresec.com/?b=2589522

PureRAT is the exact same malware as what Morphisec and others call #ResolverRAT. #PureHVNC, on the other hand, is the predecessor to #PureRAT.

IOCs:
👾 193.26.115.125:8883
👾 purebase.ddns[.]net:8883
👾 45.74.10.38:56001
👾 139.99.83.25:56001
https://netresec.com/?b=2589522

PureRAT Malware Spikes 4x in 2025, Deploying PureLogs to Target Russian Firms – Source:thehackernews.com https://ciso2ciso.com/purerat-malware-spikes-4x-in-2025-deploying-purelogs-to-target-russian-firms-sourcethehackernews-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #PureRAT

PureRAT Malware Spikes 4x in 2025, Deploying PureLogs to Target Russian Firms – Source:thehackernews.com https://ciso2ciso.com/purerat-malware-spikes-4x-in-2025-deploying-purelogs-to-target-russian-firms-sourcethehackernews-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #PureRAT