Cybercriminals are now using AI to craft deceptive job offers, deploying PureRAT malware. Stay alert and protect your systems. #CyberSecurity #AIThreats #Phishing #PureRAT Link: thedailytechfeed.com/cybercrimina...
0
0
0
0
#PureRAT
Latest posts tagged with #PureRAT on Bluesky
Trending
Posts tagged #PureRAT
RE: infosec.exchange/@VirusBulletin/115660902...
How is this #ValleyRAT? It looks, swims and quacks like #PureRAT.
Here are some typical PureRAT indicators:
:windows: .NET malware
π TLS version is 1.0
π« JA3 = fc54e0d16d9764783542f0146a98b300 or 07af4aa9e4d215a5ee63f9a0a277fbe3
π« [β¦]
0
0
1
0
Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware reconbee.com/large-scale-...
#clickfix #phishing #phishingawareness #phishingattacks #hotel #pureRATmalware #PureRAT #malware
0
0
0
0
π New and ongoing βI Paid Twiceβ scam hits hotels and guests using #PureRAT via ClickFix attack. Attackers breach booking accounts like #Booking.com, then message travelers about fake payment issues to steal bank info.
Read π hackread.com/i-paid-twice...
#Cybersecurity #Malware #Phishing #ClickFix
1
1
0
0
~Sekoia~
Threat actors compromise hotels with PureRAT malware to steal Booking.com credentials, then phish guests for fraudulent payments.
-
IOCs: 85. 208. 84. 94, 77. 83. 207. 106, sqwqwasresbkng. com
-
#Malware #Phishing #PureRAT #ThreatIntel
0
0
0
0
Decompiled .NET code for PureRAT showing C2 server 157.66.26.209 0x0000DAC1 = TCP port 56001 0x0000DAC2 = TCP port 56002 0x0000DAC3 = TCP port 56003
The technical detail in this PureRAT analysis by Heejae Hwang (ν©ν¬μ¬) is fantastic! The analyzed #PureRAT sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.
0
0
0
0
"Priority One
Insure the safe return of more money
For analysis
All other considerations are secondary
Teammates expendable" #nufc #PureRat #IsakEarth #fuckinstagram
1
0
0
0
0
0
0
0
How to identify #PureRAT (aka #ResolverRAT):
β³οΈ C2 port is often 56001, 56002 or 56003
π’ Bot sends 04 00 00 00, then TLS handshake
π Client and server run TLS 1.0
ποΈ X.509 cert is self signed
π
X.509 cert expires 9999-12-31
netresec.com?b=2589522
1
1
1
0
>PureRAT is the exact same malware as what Morphisec and others call ResolverRAT. PureHVNC, on the other hand, is the predecessor to PureRAT.
IOCs:
πΎ 193.26.115.125:8883
πΎ purebase.ddns[.]net:8883
πΎ 45.74.10.38:56001
πΎ 139.99.83.25:56001
https://netresec.com/?b=2589522
0
0
0
0
Kaspersky reports a surge in PureRAT malware targeting Russian firms in 2025.
Attackers use phishing emails to deliver PureRAT and PureLogs a backdoor + infostealer combo. Commercial malware continues to fuel sophisticated campaigns.
#Cybersecurity #MalwareAnalysis #InfoSec #PureRAT #Russia
0
0
0
0