{
  "name": "From infostealer to full RAT: dissecting the PureRAT attack chain",
  "slug": "from-infostealer-to-full-rat-dissecting-the-purerat-attack-chain",
  "description": "An investigation into what appeared at first glance to be a \u201cstandard\u201d Python-based infostealer campaign took an interesting turn when it was discovered to culminate in the deployment of a full-featured, commercially available remote access trojan (RAT) known as PureRAT.",
  "published": "2025-10-10T18:35:52+00:00",
  "created_at": "2025-10-10T18:35:52+00:00",
  "modified_at": "2025-10-10T19:09:04+00:00",
  "created_at_opencti": "2025-10-10T18:35:52+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-10-10",
    "cryptoloader",
    "infostealer",
    "lonenone",
    "netloader",
    "purecrypter",
    "purelogs",
    "purerat",
    "pxa stealer",
    "python",
    "pythonloader",
    "service",
    "telegram",
    "winrar",
    "zip archive"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "157.66.26.209"
      },
      {
        "id": "",
        "name": "https://is.gd/s5xknuj2"
      },
      {
        "id": "",
        "name": "https://paste.rs/fVmzS"
      },
      {
        "id": "",
        "name": "https://0x0.st/8WBr.py"
      },
      {
        "id": "",
        "name": "f6ed084aaa8ecf1b1e20dfa859e8f34c4c18b7ad7ac14dc189bc1fc4be1bd709"
      },
      {
        "id": "",
        "name": "f5e9e24886ec4c60f45690a0e34bae71d8a38d1c35eb04d02148cdb650dd2601"
      },
      {
        "id": "",
        "name": "06fc70aa08756a752546198ceb9770068a2776c5b898e5ff24af9ed4a823fd9d"
      }
    ],
    "malware": [
      {
        "id": "f8b9d03b-0ceb-405d-a345-695048924686",
        "name": "PXA",
        "slug": "pxa"
      },
      {
        "id": "b20facc3-d109-4596-b143-91f7803faba3",
        "name": "PureRAT",
        "slug": "purerat"
      }
    ],
    "attack_patterns": [
      {
        "id": "f4a450ef-8297-42e5-9e47-01162138baa2",
        "name": "T1115"
      },
      {
        "id": "7d03ac30-b4e0-4ef9-bb23-80667e2c8123",
        "name": "T1127"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "6e4e21cc-92cf-4564-920e-d509bd22fd40",
        "name": "T1574"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "29398669-98ed-4766-9dac-f9632f7175ff",
        "name": "T1518"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "306ee8dc-1d64-4916-96be-18060d690ad7",
        "name": "T1499"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "31d29704-da1c-47ea-b93f-76d368813bdf",
        "name": "T1560"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://www.bleepingcomputer.com/news/security/from-infostealer-to-full-rat-dissecting-the-purerat-attack-chain/",
    "https://otx.alienvault.com/pulse/68e96e29b73e5334019b8810"
  ]
}