Stealthy Dual Malware Loader Uncovered: Executes TorNet & PureHVNC Simultaneously, Cloaked by MurmurHash2

Researchers from the Internet Initiative Japan (IIJ) have analysed a previously unknown malware loader that can simultaneously execute two distinct malware families—TorNet and PureHVNC— while using uncommon obfuscation and hashing techniques. According to Naoki Takayama, around May 2025 a ZIP file containing multiple files, including a newly discovered loader, was uploaded to VirusTotal, and this loader could run both TorNet and PureHVNC and employed MurmurHash2 for API hashing with seed value 0xB801FCDA.

The loader achieves persistence by copying itself into the local app data directory and creating a Run key entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. It uses DLL sideloading, loading a malicious version.dll renamed from the legitimate file to npHPReader64.dll, which then injects the two payloads into other processes.

The TorNet component acts as a downloader over the TOR network, while PureHVNC provides remote access capabilities, with configurations decoded from Base64 and decrypted before use. The payloads are AES-128-ECB encrypted and LZMA-compressed, with separate keys for each component: 37C1FF3236DD4989153CCAC2CA712192 for TorNet and 6CB15D6A5C9AB4C2B2885FF35836892A for PureHVNC.