Loading malware…
PureRAT is a commercial, .NET-based remote access trojan for Windows developed and sold by PureCoder. Historically identified under names including PureHVNC, Hidden Desktop, and ResolverRAT, it is distinct from the PureLogs infostealer. Its modular, plugin-based architecture supports interactive remote control, surveillance, information theft, and deployment of additional payloads.
PureRAT provides hidden VNC and remote desktop access with keyboard and mouse control, remote command execution, webcam viewing, microphone capture, real-time keylogging, screenshots, file-system and registry access, HTTP and SOCKS5 reverse proxying, and code injection. It profiles compromised hosts by collecting operating-system information, usernames, security-product details, privileges, active-window titles, and webcam availability. Collection capabilities target browser data, cryptocurrency wallets and wallet extensions, and messaging and email applications. Observed plugins monitor window titles for banking and financial-service keywords, capture associated screenshots, and replace cryptocurrency addresses in the clipboard with attacker-controlled addresses. Analyzed versions use TLS-protected command-and-control channels and Protocol Buffers messages; some additionally compress or cryptographically authenticate communications.
Delivery methods include phishing emails with recruitment, invoice, refund, damaged-goods, and hotel-booking lures; malicious archives containing disguised executables; fake installers; and ClickFix pages presenting fraudulent CAPTCHA checks. Infection chains frequently abuse legitimate signed applications for DLL side-loading and use encrypted, multistage loaders to execute PureRAT in memory. Associated loaders employ reflective .NET loading, Donut shellcode, process injection, security-telemetry impairment, and persistence through startup entries, scheduled tasks, WMI subscriptions, or COM hijacking.
PureRAT has been deployed against Russian organizations, Canadian organizations, Japanese- and Korean-language recipients, hospitality businesses, and a US accounting firm. Its use spans multiple financially motivated operations, including REF1695 and a Vietnam-nexus criminal cluster associated with PXA Stealer recruitment campaigns. Operators have also used PureRAT to deploy cryptocurrency-mining payloads.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Campaign 2 uses a multi-stage fake-installer chain to drop PureRAT v3.0.1; its C2 issued a download-and-execute task for an XMR mining payload.
in July 2025, eSentire reported an association between PureRAT, a remote access trojan (RAT) first advertised in January 2023, and GhostCrypt, a crypting service sold by an underground forum member of the same moniker, in an attack that impacted a public US accounting firm in May 2025.
These scripts systematically deploy the final payloads, which include the notorious Pay2Key ransomware, the PureLogs information stealer, and the PureRAT trojan.
Credential Theft and Remote Access Surge as AllaKore, PureRAT, and Hijack Loader Proliferate
380 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
69 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.