PureRAT and PureLogs Campaign Targeting Japanese Organizations

Summary

A sophisticated phishing campaign is targeting organizations in Japan and South Korea with deceptive emails themed around damaged products and refund requests. The attack relies on multiple loader implementations, including customized Donut loaders, Python interpreters, and BYOVD techniques to deploy PureRAT and PureLogs stealers. The malware is designed to collect sensitive data from browsers, cryptocurrency wallets, and messaging applications.

Investigation

The investigation examined email headers and identified shared delivery infrastructure using the PHP Swift Mailer library together with distinctive Feedback-ID patterns. Researchers analyzed several loader variants and uncovered techniques including DLL side-loading, AMSI and ETW bypasses, and abuse of the vulnerable Lenovo BootRepair.sys driver to terminate security products through BYOVD. The payload decryption process uses TripleDES-CBC combined with GZip compression.

Mitigation

Organizations should strengthen email filtering to identify mismatches between From and Reply-To headers as well as suspicious URL patterns. Endpoint controls should monitor for abnormal DLL side-loading, unauthorized driver installation associated with BYOVD, and unusual scheduled task creation. Restricting untrusted Python interpreters and detecting suspicious process hollowing or AMSI tampering can further reduce exposure.

Response

When PureRAT or PureLogs activity is detected, isolate affected endpoints to prevent additional data theft and C2 communication. Investigate systems for unauthorized drivers such as BootRepair.sys and check for persistence through Startup folders or Task Scheduler. Reset credentials for users whose browsers, cryptocurrency wallets, or messaging applications may have been accessed by the malware.

Simulation Execution

• Attack Narrative & Commands: The adversary has successfully gained initial access via a phishing email and is attempting to establish a Command and Control (C2) channel using the PureRAT malware. To evade standard signature-based detection, they are utilizing hardcoded domains. The simulation will attempt to resolve and connect to tirakian.com to trigger the firewall/network-based detection rule.

• Regression Test Script:

  # Simulation of PureRAT C2 connection to trigger detection
  $maliciousDomain = "tirakian.com"
  Write-Host "Attempting to simulate C2 connection to $maliciousDomain..."
  try {
      # Using Resolve-DnsName and Invoke-WebRequest to generate both DNS and Network logs
      Resolve-DnsName -Name $maliciousDomain
      Invoke-WebRequest -Uri "http://$maliciousDomain" -Method Get -UseBasicParsing
  } catch {
      Write-Host "Connection failed as expected (domain may not be live), but telemetry should be generated."
  }

• Cleanup Commands:

  # No persistent artifacts created; no cleanup required for this network-based simulation.
  Write-Host "Simulation cleanup complete."