Loading story…
Researchers analyzed Pekraut, a feature-rich .NET remote access trojan believed to be of German origin, and found samples disguised as svchost.exe under %APPDATA%\Microsoft. One sample was packed with ConfuserEx and another obfuscated with Dotfuscator, but both resolved to nearly identical malware after unpacking. The RAT supports 27 commands and uses AES-encrypted text communications, with zlib compression applied to other data types, indicating an operator-ready toolset designed for remote control rather than legitimate administration.
Pekraut establishes persistence by copying itself to %USERPROFILE%\AppData\Roaming\Microsoft\svchost.exe, altering the Winlogon Shell registry value, and creating a startup shortcut named IExplorerUpdate.lnk. It also includes installation and uninstallation routines and a Windows 10 UAC bypass using ComputerDefaults.exe. Investigators said the operator concealed command-and-control infrastructure behind portmap.io, while embedded configuration data exposed a C2 port, authentication ID, and encryption password, suggesting the malware was being prepared for broader distribution through customized builder-generated variants.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Analysis showed the operator used portmap.io to conceal the real command-and-control server IP address. The recovered configuration exposed version 1.1, C2 port 37648, an authentication ID, and an encryption password.
After deobfuscation and manual symbol renaming, researchers documented Pekraut's 27-command feature set, AES-encrypted text communications, zlib compression, persistence mechanisms, uninstallation routine, and a Windows 10 UAC bypass using ComputerDefaults.exe.
A second Pekraut sample was uploaded to VirusTotal one day after the first sample. Unlike the first, it was obfuscated with Dotfuscator rather than packed, and researchers found it was almost identical after unpacking.
One of the Pekraut samples analyzed by researchers had been uploaded to VirusTotal under the name netRat.exe. This sample was packed with ConfuserEx.
Researchers identified a fake svchost.exe in %APPDATA%\Microsoft, which led to the discovery and analysis of the Pekraut .NET remote access trojan.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have detailed a **PureRAT** campaign targeting Windows systems with a multi-stage, largely fileless infection chain that begins with a malicious `.lnk` shortcut. The shortcut launches PowerShell and an obfuscated VBScript loader, which retrieves a PNG image carrying a hidden Base64-encoded PE payload via steganography and loads it directly into memory. The malware then applies several defense-evasion techniques, including anti-analysis checks for **VMware** and **QEMU**, **UAC bypass** through `cmstp.exe`, and **process hollowing** into `msbuild.exe`, while additional components are protected with .NET Reactor and decrypted in memory with **TripleDES**. Once active, PureRAT fingerprints the infected host by collecting details on security tools, hardware, privileges, OS configuration, webcam presence, idle time, and possible cryptocurrency wallet artifacts, then connects to command-and-control infrastructure including `crixup[.]com` and `instantservices1[.]ddnsguru[.]com:1917` linked to `178[.]16[.]52[.]58`. Operators can deploy modular capabilities such as **keylogging**, **remote desktop access**, environmental monitoring, and broader remote control, while persistence is maintained through scheduled tasks and registry run keys. Published reporting and threat research describe the malware as a high-severity RAT and include indicators of compromise such as domains, an IP address, and multiple SHA-256 hashes to support detection and response.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Ukrainian government entities were targeted in a cyber-espionage campaign attributed to **UAC-0050** that deployed **Remcos RAT** through a malicious `.lnk` file and a multi-stage chain using `mshta.exe`, obfuscated VBScript, and PowerShell. Researchers said the malware downloaded a decoy document themed around consultancy and Israel Defense Forces training, then established persistence in `AppData` before using unnamed Windows pipes to move decrypted payload data into `cmd.exe` memory, a technique designed to evade EDR and antivirus tools. The analyzed **Remcos 4.9.2 Pro** sample was configured to contact `194.87.31.229:6438` under the botnet name **RemoteHost** and was observed collecting victim data, altering registry settings, and removing browser data. The operation fits a broader pattern of **Remcos** use across phishing and espionage campaigns, where attackers repeatedly rely on lures such as invoices, war-related themes, password-protected documents, and malicious archives to deliver the RAT. Prior reporting has documented Remcos infections using Office exploits, macros, PowerShell loaders, UAC-bypass techniques, process injection, and fileless or in-memory execution, while later tracking of UAC-0050 linked the cluster to continued operations against Ukraine using shifting malware families and suspicious hosting infrastructure. The campaign underscores how a commercially available RAT continues to be adapted by both criminal and state-aligned operators for stealthy access, surveillance, and follow-on intrusion activity.
Aug 15, 2026