From infostealer to full RAT: dissecting the PureRAT attack chain

Oct. 10, 2025, 9:09 p.m.

Description

An investigation into what appeared at first glance to be a “standard” Python-based infostealer campaign took an interesting turn when it was discovered to culminate in the deployment of a full-featured, commercially available remote access trojan (RAT) known as PureRAT.

Date

  • Created: Oct. 10, 2025, 8:35 p.m.
  • Published: Oct. 10, 2025, 8:35 p.m.
  • Modified: Oct. 10, 2025, 9:09 p.m.

Indicators

  • f6ed084aaa8ecf1b1e20dfa859e8f34c4c18b7ad7ac14dc189bc1fc4be1bd709
  • f5e9e24886ec4c60f45690a0e34bae71d8a38d1c35eb04d02148cdb650dd2601
  • 06fc70aa08756a752546198ceb9770068a2776c5b898e5ff24af9ed4a823fd9d
  • 157.66.26.209
  • https://is.gd/s5xknuj2
  • https://paste.rs/fVmzS
  • https://0x0.st/8WBr.py

Attack Patterns