Malware

PureRAT

Also known as: PureHVNC · ResolverRAT

According to Morphisec, this RAT combines advanced in-memory execution, API and resource resolution at runtime, and layered evasion techniques. They have named it ‘Resolver’ due to its heavy reliance on runtime resolution mechanisms and dynamic resource handling, which make static and behavioral analysis significantly more difficult.

Indicators of Compromise 12

MD5 010301d23beacee631006245ed09a2f7 MD5 323fed78fc8aaa86c3d35aa85313645d MD5 3c9852c53cb45221886b34ed6bc7d674 MD5 404f0d36fcbe5c4643e821403a4827eb MD5 7e49bac468548a0e83133f0d5b02544b MD5 b4400998cf293b0767455fb37526b18e IP 196[.]251[.]107[.]6 IP 204[.]44[.]93[.]88 IP 45[.]192[.]211[.]59 IP 46[.]151[.]182[.]159 IP 5[.]101[.]84[.]75 IP 85[.]239[.]149[.]178

Source Articles

PureLogs, PureRAT and misleading zgRAT

The article clarifies confusion between malware families attributed to developer PureCoder, specifically distinguishing PureLogs, an infostealer, from PureRAT, a Remote Access Trojan (RAT). Both are .NET-based and have been mislabeled as zgRAT in detection rules, leading to false positives. The article provides technical indicators and Suricata signatures for detecting PureLogs and PureRAT, emphasizing the importance of accurate classification to avoid misattribution.

static-urls