From Infostealer to Full RAT: Huntress Uncovers a Multi-Stage Malware Attack Deploying PureRAT

According to Huntress, a recent intrusion campaign began as a Python-based infostealer but escalated into the deployment of PureRAT, a commercially available remote access trojan. The attack starts with a phishing email containing a ZIP archive disguised as a copyright infringement notice, delivering a signed PDF reader executable and a malicious version.dll that forces the legitimate program to load the attacker’s code via DLL sideloading.

The malware then uses certutil.exe and a bundled WinRAR to unpack a hidden Python interpreter and script, executing entirely in memory to avoid detection. The operators chained ten distinct payloads or stages, progressively increasing in complexity to conceal their ultimate objective, with the Python payload modifying registry keys to add a run key that masquerades as a Windows Update Service.

Later stages pull payloads from shortened URLs and Telegram bots, providing a flexible mechanism to refresh their toolset, culminating in PureRAT, which Huntress describes as a modular backdoor granting full control over a compromised host. The campaign is linked by Telegram infrastructure and metadata to @LoneNone and PXA Stealer, with C2 servers traced to Vietnam, suggesting attribution to the PXA Stealer actors; PureRAT’s providers are named as PureCoder.