#PureRat - Twitter Hashtag

moto_sato

@58_158_177_102

7 days ago

#pureRAT

misaki @tdatwja

7 days ago

日本語マルウェアメールの接到を確認しています。件名: ①交換または返金をお願いいたします　②配送された商品が破損しています MD5: 1fdea279cb8c9217487ac4c86ae9316c 通信先: tirakian[.]com Sample: https://t.co/VTCPiIHah1

tdatwja's tweet photo. 日本語マルウェアメールの接到を確認しています。

件名: ①交換または返金をお願いいたします
　②配送された商品が破損しています
MD5: 1fdea279cb8c9217487ac4c86ae9316c
通信先: tirakian[.]com
Sample: https://t.co/VTCPiIHah1 https://t.co/dTSFoi3qv1

1

9

7

3

6K

0

6

2

3

2K

JAMESWT @JAMESWT_WT

13 days ago

"Richiesta di sostituzione o rimborso a causa del danno del prodotto" 👇 ⛔️pixeldrain.]com/api/filesystem/n5qSvmec/Full_Unboxing_Process_Inspection_Record_2026_391231.zip 👇 ⛔️C2 #PureRAT 45.139.226.]211:56001 Samples https://t.co/2vprO6CdAD AnyRun https://t.co/lCwhcTkXaO

JAMESWT_WT's tweet photo. "Richiesta di sostituzione o rimborso a causa del danno del prodotto"
👇
⛔️pixeldrain.]com/api/filesystem/n5qSvmec/Full_Unboxing_Process_Inspection_Record_2026_391231.zip
👇
⛔️C2 #PureRAT
45.139.226.]211:56001

Samples
https://t.co/2vprO6CdAD

AnyRun
https://t.co/lCwhcTkXaO https://t.co/6BWFuKvGXY

1

15

3

2

2K

James @James_inthe_box

20 days ago

Fresh #purerat : https://t.co/bQjrVUKMjn

0

11

1

5

955

Luke Acha

@luke92881

about 1 month ago

Observed newer #PureRAT https://t.co/T4n9HL3RFz PYC file execution after reboot (Run Key) > Multi-Stage PYC with Base85 + Zlib + RC4, XOR, AES > Shellcode > .NET with multiple protections, and more embedded .NET binaries.

1

8

7

2

968

Daily CyberSecurity @Daily_CyberSec

3 months ago

Trellix uncovers PureRAT, a modular Trojan hiding malware in PNG images. Learn how it uses steganography and fileless delivery to bypass Windows security. #PureRAT #CyberSecurity #MalwareAnalysis #Steganography #InfoSec #Trellix #RAT https://t.co/85yyzh675t

Daily_CyberSec's tweet photo. Trellix uncovers PureRAT, a modular Trojan hiding malware in PNG images. Learn how it uses steganography and fileless delivery to bypass Windows security.

#PureRAT #CyberSecurity #MalwareAnalysis #Steganography #InfoSec #Trellix #RAT
https://t.co/85yyzh675t https://t.co/ZhpDsVmBDH

0

36

10

7

2K

Threat Intelligence @threatintel

6 months ago

Find out how attackers are using AI help them write code, speeding up their workflows, allowing them to retool quickly. https://t.co/ALsjNipcIW #pureRAT #AI

0

1

0

2K

Threat Intelligence @threatintel

6 months ago

How are attackers actually using AI in the wild? Here's a good example, a cybercrime actor leveraging AI to automate their workflow, such as writing Python and batch scripts used in their attacks. https://t.co/ALsjNipcIW #pureRAT #AI

0

4

3

2

3K

Aaron Jornet

@RexorVc0

7 months ago

#TA #BlindEagle APT-C-36 #Hijackloader #PureRat #Threat #Malware 📍🇨🇴 💥🇪🇨🇨🇱🇵🇦🌎 ⛓️ #Phishing > SVG > Download > Fake doc (EXE) + DLLs > EXE load DLL > Inject code > #Hijackloader > Persistence > 2nd Inject > TeraNa.exe > #PureRAT > #C2 🔗360 Threat Intelligence: https://t.co/dLadxqzHL8

RexorVc0's tweet photo. #TA #BlindEagle APT-C-36 #Hijackloader #PureRat #Threat #Malware

📍🇨🇴
💥🇪🇨🇨🇱🇵🇦🌎

⛓️ #Phishing > SVG > Download > Fake doc (EXE) + DLLs > EXE load DLL > Inject code > #Hijackloader > Persistence > 2nd Inject > TeraNa.exe > #PureRAT > #C2

🔗360 Threat Intelligence: https://t.co/dLadxqzHL8

4

105

25

35

7K

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec

8 months ago

@virusbtn @TrendMicro what artifacts indicate that this is ValleyRAT? This execution of ebcfc4f6c6e63b75dc407f5e76c9d96c69c3c1b6 looks much more like #PureRAT 🤷 https://t.co/TzkBfnzskk

1

5

1

2

1K

SC Media @SCMagazine

8 months ago

Hackers are using compromised hotel accounts to target travelers via spoofed @bookingcom pages — powered by #ClickFix and #PureRAT malware, according to @sekoia_io. #cybersecurity #CISO #infosec #ITsecurity https://t.co/yTYQyw57pi

0

1

0

408

SC Media @SCMagazine

8 months ago

Hackers are using compromised hotel accounts to target travelers via spoofed @bookingcom pages — powered by #ClickFix and #PureRAT malware, according to @sekoia_io. #cybersecurity #CISO #infosec #ITsecurity https://t.co/yTYQyw57pi

0

1

0

1

530

SC Media @SCMagazine

8 months ago

Hackers are using compromised hotel accounts to target travelers via spoofed @bookingcom pages — powered by #ClickFix and #PureRAT malware, according to @sekoia_io. #cybersecurity #CISO #infosec #ITsecurity https://t.co/yTYQyw57pi

0

497

SC Media @SCMagazine

8 months ago

Hackers are using compromised hotel accounts to target travelers via spoofed @bookingcom pages — powered by #ClickFix and #PureRAT malware, according to @sekoia_io. #cybersecurity #CISO #infosec #ITsecurity https://t.co/yTYQyw57pi

0

5

3

0

541

Threat Intelligence @threatintel

8 months ago

#ThreatProtection A new #phishing campaign targeting #hospitality industry customers, read more about Symantec's protection: https://t.co/CjP2yyLSFF #purerat #malware

0

2

0

1K

Hackread.com @HackRead

9 months ago

🛑 “I Paid Twice” scam hits hotels and guests using #PureRAT via ClickFix. Attackers breach booking accounts like #Booking.com, then message travelers about fake payment issues to steal bank info. Read 🔗 https://t.co/T7isjJ6Mu1 #Cybersecurity #Malware #Phishing #ClickFix

0

8

5

2

2K

N_{Dario Fadda} @nuke86

9 months ago

🇮🇹 #phishing #email 👇 multi-stage malware deployment 👇 Sample name: Bper.Banca.Copia.di.Pagamento.pdf.bat 👇 #RemcosRAT, #PureRAT C2: 91.92.241[.]175:9385 🔗 JoeSandbox report: https://t.co/SUQTn0e7GU

nuke86's tweet photo. 🇮🇹 #phishing #email
👇
multi-stage malware deployment
👇
Sample name: Bper.Banca.Copia.di.Pagamento.pdf.bat
👇
#RemcosRAT, #PureRAT

C2: 91.92.241[.]175:9385

🔗 JoeSandbox report: https://t.co/SUQTn0e7GU https://t.co/hLnFMpqQY8

1

6

2

1K

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec

9 months ago

The technical detail in this #PureRAT analysis by Heejae Hwang (황희재) is fantastic! https://t.co/2ULvBtADK5

1

94

20

37

6K

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec

10 months ago

@JAMESWT_WT @500mk500 The traffic to 85.208.84.94:56001 (sqwqwasresbkng[.]com) looks like #PureRAT C2.

1

3

1

0

196

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec

11 months ago

@JAMESWT_WT @AndreaDraghetti @signorina37H @guelfoweb @VirITeXplorer @1ZRR4H @0xToxin @pr0xylife @c_APT_ure @ShadowOpCode @marsomx_ @anyrun_app This transcript of ANY.RUN PCAP displays several #ResolverRAT / #PureRAT indicators: 🔢 04 00 00 00 (before TLS) 🔑 Client and server run TLS 1.0 📅 X.509 cert expires 9999-12-31 More details on PureRAT indicators here: https://t.co/GlSDXfsgP0