Top Tweets for #PureRAT
日本語マルウェアメールの接到を確認しています。
件名: ①交換または返金をお願いいたします
②配送された商品が破損しています
MD5: 1fdea279cb8c9217487ac4c86ae9316c
通信先: tirakian[.]com
Sample: https://t.co/VTCPiIHah1
![tdatwja's tweet photo. 日本語マルウェアメールの接到を確認しています。
件名: ①交換または返金をお願いいたします
②配送された商品が破損しています
MD5: 1fdea279cb8c9217487ac4c86ae9316c
通信先: tirakian[.]com
Sample: https://t.co/VTCPiIHah1 https://t.co/dTSFoi3qv1](https://pbs.twimg.com/media/HNQfrRrbAAAB681.png)
"Richiesta di sostituzione o rimborso a causa del danno del prodotto"
👇
⛔️pixeldrain.]com/api/filesystem/n5qSvmec/Full_Unboxing_Process_Inspection_Record_2026_391231.zip
👇
⛔️C2 #PureRAT
45.139.226.]211:56001
Samples
https://t.co/2vprO6CdAD
AnyRun
https://t.co/lCwhcTkXaO
![JAMESWT_WT's tweet photo. "Richiesta di sostituzione o rimborso a causa del danno del prodotto"
👇
⛔️pixeldrain.]com/api/filesystem/n5qSvmec/Full_Unboxing_Process_Inspection_Record_2026_391231.zip
👇
⛔️C2 #PureRAT
45.139.226.]211:56001
Samples
https://t.co/2vprO6CdAD
AnyRun
https://t.co/lCwhcTkXaO https://t.co/6BWFuKvGXY](https://pbs.twimg.com/media/HMx1-eNWUAAEgQe.png)

Observed newer #PureRAT
https://t.co/T4n9HL3RFz
PYC file execution after reboot (Run Key) >
Multi-Stage PYC with Base85 + Zlib + RC4, XOR, AES >
Shellcode > .NET with multiple protections, and more embedded .NET binaries.
Trellix uncovers PureRAT, a modular Trojan hiding malware in PNG images. Learn how it uses steganography and fileless delivery to bypass Windows security.
#PureRAT #CyberSecurity #MalwareAnalysis #Steganography #InfoSec #Trellix #RAT
https://t.co/85yyzh675t

#TA #BlindEagle APT-C-36 #Hijackloader #PureRat #Threat #Malware
📍🇨🇴
💥🇪🇨🇨🇱🇵🇦🌎
⛓️ #Phishing > SVG > Download > Fake doc (EXE) + DLLs > EXE load DLL > Inject code > #Hijackloader > Persistence > 2nd Inject > TeraNa.exe > #PureRAT > #C2
🔗360 Threat Intelligence: https://t.co/dLadxqzHL8

Hackers are using compromised hotel accounts to target travelers via spoofed @bookingcom pages — powered by #ClickFix and #PureRAT malware, according to @sekoia_io. #cybersecurity #CISO #infosec #ITsecurity https://t.co/yTYQyw57pi
Hackers are using compromised hotel accounts to target travelers via spoofed @bookingcom pages — powered by #ClickFix and #PureRAT malware, according to @sekoia_io. #cybersecurity #CISO #infosec #ITsecurity https://t.co/yTYQyw57pi
Hackers are using compromised hotel accounts to target travelers via spoofed @bookingcom pages — powered by #ClickFix and #PureRAT malware, according to @sekoia_io. #cybersecurity #CISO #infosec #ITsecurity https://t.co/yTYQyw57pi
Hackers are using compromised hotel accounts to target travelers via spoofed @bookingcom pages — powered by #ClickFix and #PureRAT malware, according to @sekoia_io. #cybersecurity #CISO #infosec #ITsecurity https://t.co/yTYQyw57pi
#ThreatProtection A new #phishing campaign targeting #hospitality industry customers, read more about Symantec's protection: https://t.co/CjP2yyLSFF #purerat #malware
🇮🇹 #phishing #email
👇
multi-stage malware deployment
👇
Sample name: Bper.Banca.Copia.di.Pagamento.pdf.bat
👇
#RemcosRAT, #PureRAT
C2: 91.92.241[.]175:9385
🔗 JoeSandbox report: https://t.co/SUQTn0e7GU
![nuke86's tweet photo. 🇮🇹 #phishing #email
👇
multi-stage malware deployment
👇
Sample name: Bper.Banca.Copia.di.Pagamento.pdf.bat
👇
#RemcosRAT, #PureRAT
C2: 91.92.241[.]175:9385
🔗 JoeSandbox report: https://t.co/SUQTn0e7GU https://t.co/hLnFMpqQY8](https://pbs.twimg.com/media/G33UCx1XUAAb9M2.jpg)
The technical detail in this #PureRAT analysis by Heejae Hwang (황희재) is fantastic!
https://t.co/2ULvBtADK5

@JAMESWT_WT @500mk500 The traffic to 85.208.84.94:56001 (sqwqwasresbkng[.]com) looks like #PureRAT C2.
@JAMESWT_WT @AndreaDraghetti @signorina37H @guelfoweb @VirITeXplorer @1ZRR4H @0xToxin @pr0xylife @c_APT_ure @ShadowOpCode @marsomx_ @anyrun_app This transcript of ANY.RUN PCAP displays several #ResolverRAT / #PureRAT indicators:
🔢 04 00 00 00 (before TLS)
🔑 Client and server run TLS 1.0
📅 X.509 cert expires 9999-12-31
More details on PureRAT indicators here:
https://t.co/GlSDXfsgP0

@JAMESWT_WT @AndreaDraghetti @signorina37H @guelfoweb @VirITeXplorer @1ZRR4H @0xToxin @pr0xylife @c_APT_ure @ShadowOpCode @marsomx_ #PureRAT aka #ResolverRAT is dropped in the execution on @anyrun_app

Last Seen Hashtags on Sotwe
Most Popular Users

Elon Musk 
@elonmusk
241M followers

Barack Obama 
@barackobama
119.2M followers

Cristiano Ronaldo 
@cristiano
111.9M followers

Donald J. Trump 
@realdonaldtrump
111.8M followers

Narendra Modi 
@narendramodi
107M followers

Rihanna 
@rihanna
98M followers

NASA 
@nasa
92.2M followers

Justin Bieber 
@justinbieber
91.2M followers

KATY PERRY 
@katyperry
88.4M followers

Taylor Swift 
@taylorswift13
82.2M followers

Lady Gaga 
@ladygaga
73.7M followers

Virat Kohli 
@imvkohli
71M followers

Kim Kardashian 
@kimkardashian
70.1M followers

YouTube 
@youtube
68.7M followers

Bill Gates 
@billgates
64.3M followers

Neymar Jr 
@neymarjr
63.8M followers

The Ellen Show
@theellenshow
62.4M followers

CNN 
@cnn
61.8M followers

Selena Gomez 
@selenagomez
61.4M followers

X 
@x
60.8M followers


![tdatwja's tweet photo. 日本語マルウェアメールの接到を確認しています。
件名: ①交換または返金をお願いいたします
②配送された商品が破損しています
MD5: 1fdea279cb8c9217487ac4c86ae9316c
通信先: tirakian[.]com
Sample: https://t.co/VTCPiIHah1 https://t.co/dTSFoi3qv1](https://pbs.twimg.com/media/HNQe2-2agAAkCOl.png)

![JAMESWT_WT's tweet photo. "Richiesta di sostituzione o rimborso a causa del danno del prodotto"
👇
⛔️pixeldrain.]com/api/filesystem/n5qSvmec/Full_Unboxing_Process_Inspection_Record_2026_391231.zip
👇
⛔️C2 #PureRAT
45.139.226.]211:56001
Samples
https://t.co/2vprO6CdAD
AnyRun
https://t.co/lCwhcTkXaO https://t.co/6BWFuKvGXY](https://pbs.twimg.com/media/HMx13znW0AA2k4X.png)
![JAMESWT_WT's tweet photo. "Richiesta di sostituzione o rimborso a causa del danno del prodotto"
👇
⛔️pixeldrain.]com/api/filesystem/n5qSvmec/Full_Unboxing_Process_Inspection_Record_2026_391231.zip
👇
⛔️C2 #PureRAT
45.139.226.]211:56001
Samples
https://t.co/2vprO6CdAD
AnyRun
https://t.co/lCwhcTkXaO https://t.co/6BWFuKvGXY](https://pbs.twimg.com/media/HMx1z9CXgAAv9rZ.png)
![JAMESWT_WT's tweet photo. "Richiesta di sostituzione o rimborso a causa del danno del prodotto"
👇
⛔️pixeldrain.]com/api/filesystem/n5qSvmec/Full_Unboxing_Process_Inspection_Record_2026_391231.zip
👇
⛔️C2 #PureRAT
45.139.226.]211:56001
Samples
https://t.co/2vprO6CdAD
AnyRun
https://t.co/lCwhcTkXaO https://t.co/6BWFuKvGXY](https://pbs.twimg.com/media/HMx1ze7XEAAahrj.png)








