Loading malware…
PureHVNC is a legacy name for PureRAT, a .NET remote access trojan developed by PureCoder; the PureHVNC and Hidden Desktop labels were used for PureRAT samples until approximately 2023. PureRAT provides Hidden VNC and remote desktop access, remote command execution, webcam viewing, microphone capture, real-time keylogging, HTTP and SOCKS5 reverse proxying, and code injection. Samples identified under the legacy PureHVNC label have also been reported collecting browser data, cryptocurrency-wallet data, and basic host information. PureHVNC/PureRAT has been distributed through business-themed malspam, including Italian-language invoice, order, request, payment, and bank-transfer lures, and through ClickFix-style social engineering that induces victims to execute PowerShell. Observed delivery chains have used staged payloads, DLL side-loading, persistence, and in-memory process injection to reduce visibility. It targets Windows systems.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
As documented by OpenSourceMalware, the adversary leveraged the network to host a PUREHVNC RAT C2.
52 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development Web Services: Cloudflare Tunnels T1583.006 1–6 Free Quick Tunnel, no account required
On a rainy Friday around lunchtime, we received a phishing email saying we had an unpaid invoice, with an attached SVG file.
The Italian campaigns ... were grouped according to macro categories, obtained from the subject of the email message used for malware distribution (malspam). The top-ranking samples this week are Script files ... Office documents ... follow in second place.
[Phishing Email] → German invoice / scan / Telekom lure link or attachment
To hold access, the malware creates a scheduled task through a base64-encoded PowerShell command at the highest privilege level when admin rights are present, leaving the mutex “Rluukgz” on the host as a marker.
The execute_shellcode function contains a huge base64-encoded string, which is decrypted using RC4, allocated as executable memory using Windows APIs, and then jumped into.
The initial command uses iex(irm ...), while a later PowerShell process runs with "-NoProfile -NonInteractive -NoLogo -Command -" and receives its script via STDIN.
WSJ25F.bat is an obfuscated batch script
lamoor.vbs is a simple VBScript that downloads and executes a file also called WSJ25F.bat
The startup file changes the directory to %Userprofile%\Downloads\Support\Python312 and executes the Python scripts EAdate.py, FAScis.py, GXrop.py and HPUope.py
When opening the .SVG file in a web browser, the contained JavaScript code is executed, which extracts a .HTM file from a base64 blob and “downloads” it.
The execute_shellcode function contains a huge base64-encoded string, which is decrypted using RC4, allocated as executable memory using Windows APIs, and then jumped into.
Below we see the subjects used in the various campaigns divided by day and type of malware.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution User Execution: Malicious Link T1204.001 ClickFix/FakeCaptcha pages
When opening the .SVG file in a web browser, the contained JavaScript code is executed, which extracts a .HTM file from a base64 blob and “downloads” it.
After patching, Donut loads mscoree.dll , calls CLRCreateInstance to start the .NET CLR (v4.0.30319), and invokes ExecuteInDefaultAppDomain with the target class and method names stored in the instance.
To hold access, the malware creates a scheduled task through a base64-encoded PowerShell command at the highest privilege level when admin rights are present, leaving the mutex “Rluukgz” on the host as a marker.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Persistence Boot or Logon Autostart: Registry Run Keys T1547.001 HKCU...\CurrentVersion\Run
To hold access, the malware creates a scheduled task through a base64-encoded PowerShell command at the highest privilege level when admin rights are present, leaving the mutex “Rluukgz” on the host as a marker.
Injector generated by laZzzy, injects into notepad.exe
Injection technique: create a suspended notepad.exe , allocate RWX memory, write shellcode via WriteProcessMemory , queue an APC, resume the thread... Instead of notepad.exe, the loaders now create a suspended explorer.exe and use Early Bird APC injection
The decrypted stage... injects into a freshly spawned winver.exe... the winver.exe injection is the same move to hollow a small signed binary.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Persistence Boot or Logon Autostart: Registry Run Keys T1547.001 HKCU...\CurrentVersion\Run
It assembles the cmdlet name at runtime as 'Invoke-We' + 'bRequest'... The interpreter name pythonw.exe is built up a character at a time.
MITRE ATT&CK Mapping Technique ID Implementation ... Obfuscated Files: Software Packing T1027.002 Donut shellcode packer
"...calls Assembly.Load() to reflectively load the inner assembly. The inner assembly is invoked via InvokeMember(...)"
The hidden pythonw.exe RC4-decrypts an encrypted stage, j7gTcSQdBc15W11UfhQkrIw3WG.jsxi, with a hardcoded key and runs it entirely in memory through exec().
Scan_0620954916911.pdf.wsh is a 127-byte Windows Script Host settings file with a .pdf.wsh double extension.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Masquerading: Match Legitimate Name T1036.005 msedge_elf.dll, libpsl-5.dll
Injector generated by laZzzy, injects into notepad.exe
Injection technique: create a suspended notepad.exe , allocate RWX memory, write shellcode via WriteProcessMemory , queue an APC, resume the thread... Instead of notepad.exe, the loaders now create a suspended explorer.exe and use Early Bird APC injection
The decrypted stage... injects into a freshly spawned winver.exe... the winver.exe injection is the same move to hollow a small signed binary.
kill parent processes via WMI VBS helpers, then delete themselves and the VBS files.
The execute_shellcode function contains a huge base64-encoded string, which is decrypted using RC4
The campaign also highlights increasing abuse of legitimate Windows utilities and trusted binaries to evade conventional security controls.
PowerShell: csc.exe compiles ClassLibrary17.dll from %TEMP%; InstallUtil.exe /u launches PureHVNC component; C2: 176.65.144[.]46:65001
"EcoOptimize uses two tasks... both triggering via wscript.exe every 5 minutes."
If detected, downloads abb11.zip (OBKS-only, Avast-safe profile). If not, downloads quz11.zip (full WBKS + BKSNO deployment).
Checks for AvastUI.exe and AVGUI.exe via tasklist. If detected, downloads abb11.zip (OBKS-only, Avast-safe profile). If not, downloads quz11.zip
UKM032.bat ... Hides payload folders with attrib +h
After patching, Donut loads mscoree.dll , calls CLRCreateInstance to start the .NET CLR (v4.0.30319), and invokes ExecuteInDefaultAppDomain with the target class and method names stored in the instance.
exec(rc4(key,screnc).decode('utf-8'))
Once running, the DLL decrypts strings through XOR with the key “4B” and checks for analysis environments using IsDebuggerPresent() and time64(). If sandbox or debugging activity is found, the malware shows the error “This software has expired or debugger detected” and halts.
"PWS.vbs F15... Every 55 seconds" and "pws1.vbs Shift Every 40 seconds"
Browser credential theft : targets 30+ Chromium-based browsers via profile directory enumeration under AppData.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Discovery System Owner/User Discovery T1033 Username, admin status collection
MITRE ATT&CK Mapping Tactic Technique ID Implementation Discovery System Information Discovery T1082 PS1 fingerprinting (OS, model, AV products)
If detected, downloads abb11.zip (OBKS-only, Avast-safe profile). If not, downloads quz11.zip (full WBKS + BKSNO deployment).
Checks for AvastUI.exe and AVGUI.exe via tasklist. If detected, downloads abb11.zip (OBKS-only, Avast-safe profile). If not, downloads quz11.zip
Once running, the DLL decrypts strings through XOR with the key “4B” and checks for analysis environments using IsDebuggerPresent() and time64(). If sandbox or debugging activity is found, the malware shows the error “This software has expired or debugger detected” and halts.
MITRE ATT&CK Mapping Technique ID Implementation ... Remote Services: VNC T1021.005 PureHVNC hidden VNC
"PWS.vbs F15... Every 55 seconds" and "pws1.vbs Shift Every 40 seconds"
Collection Screen Capture T1113 PureHVNC remote desktop capture
Command and Control Fallback Channels T1008 22 C2 IPs, 8 domains, 10+ port options
CRYPTBASE.dll side-loaded by CPU-Z binary; STXRAT dropper executes; C2 beacon to welcome.supp0v3[.]com
C2 Application Layer Protocol: Web Protocols T1071.001 1–6 WebDAV over HTTPS for staging
MITRE ATT&CK Mapping Tactic Technique ID Implementation C2 Web Service T1102 Cloudflare-proxied C2
The stager downloads and launches IntelSoftwareUpdaterV8.exe; the second PowerShell loader pulls Python.zip and Learn.zip from whitecarkiario[.]com/Smoke/.
MITRE ATT&CK Mapping Technique ID Implementation ... Dynamic Resolution: DNS T1568.002 DuckDNS dynamic DNS for all C2
Command and Control Non-Standard Port T1571 Ports 56001, 4782, 1337, 7777, 9090
MITRE ATT&CK Mapping Technique ID Implementation ... Encrypted Channel: Asymmetric Crypto T1573.002 AsyncRAT TLS with self-signed RSA-4096
All tunnels use Cloudflare's free Quick Tunnel service ( trycloudflare.com ). The origin server IP is never exposed — all traffic proxies through Cloudflare's anycast network
It instructs rundll32.exe to load davclnt.dll for a WebDAV/SSL fetch from the first Cloudflare tunnel.
175 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.