PureRATMalware
- purehvnc
- resolverrat
According to Morphisec, this RAT combines advanced in-memory execution, API and resource resolution at runtime, and layered evasion techniques. They have named it ‘Resolver’ due to its heavy reliance on runtime resolution mechanisms and dynamic resource handling, which make static and behavioral analysis significantly more difficult.From MISP Galaxy
Last reported 27 days ago, by Risky Business News6 reports
ATT&CK techniques
6 of 22 · each with the sentence it comes from- T1027.009Embedded Payloads
“Its Stage 2 resembles Campaign 2 but differs by dropping multiple embedded payloads from the resource section, including PureRAT, a custom XMRig loader, and PureMiner.”
- T1055Process Injection
“…nt execution by the persistence mechanism, it verifies that it is running from its installation directory before proceeding to the process injection phase.”
- T1055.012Process Hollowing
“T1055.012”
- T1056.001Keylogging
“These plugins could add functionality for anything from microphone/webcam access to real-time keylogging and hidden desktop access.”
- T1684Social Engineering
“…cross all observed campaigns, the infection chains share a consistent packing technique, overlapping C2 infrastructure, and common social engineering patterns, linking them to a single operator.”
- T1027Obfuscated Files or Information
“T1027”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Risky Bulletin: Intel ends paid bug bounties“PureRAT and PureLogs: ITOCHU's security team looks at PureRAT and PureLogs, two malware strains part of the same malware family and linked to e-crime activity.”
-
Malware Crypting Services and the Threat Actors Who Sell Them“For instance, in July 2025, eSentire reported an association between PureRAT, a remote access trojan (RAT) first advertised in January 2023, and GhostCrypt, a crypting service sold by an underground forum member of the same moniker, in an attack that impacted a public US accounti…”
-
Booking.com Phishing Campaign Targeting Hotels and Customers“Sekoia.io exposes a Booking.com phishing campaign targeting hotels and customers using ClickFix and PureRAT malware.”
-
Fake Installers to Monero: A Multi-Tool Mining Operation“Campaign 2 (PureRAT)”
-
PureRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading“PureRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading”
-
A Vietnamese threat actor's shift from PXA Stealer to PureRAT“A Vietnamese threat actor's shift from PXA Stealer to PureRAT”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
- rule[.]inin 1 report
- process[.]pidin 1 report
- action.properties[.]companyin 1 report
- d4845669f7f56c6c4eb82147a1f82615in 1 report
- 9bab404584f6a0d9…132fd145dd32in 1 report
- 799e73863806df2964d80d12ce4e61eain 1 report
- headkickscountry[.]comin 1 report
- activatecapagm[.]comin 1 report
- homelycareinc[.]comin 1 report
- byliljedahl[.]comin 1 report
- jamerimprovementsllc[.]comin 1 report
- seedsuccesspath[.]comin 1 report
- zenavuurwerkofficial[.]comin 1 report
- brownsugarcheesecakebar[.]comin 1 report
- hareandhosta[.]comin 1 report
- customvanityco[.]comin 1 report
- ctrlcapaserc[.]comin 1 report
- bknqsercise[.]comin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.