Under the Pure Curtain: From RAT to Builder to Coder

According to Check Point Research, a forensic analysis of the ClickFix campaign reveals an eight-day intrusion during which a Rust Loader deployed PureHVNC RAT alongside PureRAT components, and connections to the Sliver C2 framework were observed. The campaign lured victims with fake job offers via the ClickFix phishing technique, delivering a Rust Loader that deployed PureHVNC RAT with campaign IDs 2a and amazon3, and malicious PowerShell was used to trigger the infection chain.

The analysis also shows the bot receiving three GitHub URLs linked to the developer PureCoder, with the GitHub accounts and UTC+0300 timezone underpinning suspected geographic locations; a PureRAT builder and PureCrypter are documented as part of the ecosystem.

The report details extensive anti-analysis and persistence techniques, including AMSI bypass hooks, registry- and scheduled-task–based persistence, and a protobuf-based configuration that specifies C2 server, port, TLS certificate, and various plugin commands. Notably, PureHVNC’s C2 is characterized as 54.197.141[.]245, and the investigation ties several GitHub repositories and hardcoded URLs to PureCoder’s operations.