Investigation Traces Phishing Campaign From Python Infostealer to PureRAT

Summary

Huntress details a 10-stage phishing infection chain that progressed from Python loaders and an infostealer to PureRAT, explaining its persistence, evasion, host fingerprinting and encrypted C2. SOC remediation stopped deployment of additional plugins.

Key points

The campaign began with a phishing ZIP disguised as a copyright notice; a signed PDF reader sideloaded a malicious DLL.
Early Python stages used layered loaders and obfuscation, then harvested browser credentials, cookies, credit cards and autofill data and sent archives via Telegram.
Later stages used process hollowing, patched AMSI, unhooked ETW and loaded .NET payloads in memory.
PureRAT fingerprinted infected hosts and used a TLS-pinned, encrypted C2 channel to receive tasks and load modules.
Huntress says its SOC isolated and remediated the infected host before additional PureRAT plugins were deployed.
The Telegram handle and infrastructure led the researchers to say the campaign strongly suggests links to the PXA Stealer operators; attribution is not presented as confirmed.

Article Details

Attack Vectors: A phishing email delivered a ZIP archive disguised as a copyright infringement notice; it contained a signed PDF reader executable and a malicious version.dll that was loaded through DLL sideloading.
A multi-stage loader chain used certutil.exe, a bundled renamed WinRAR copy, a renamed Python interpreter, and obfuscated Python and .NET payloads.
The loaders used process hollowing to execute a malicious .NET payload inside RegAsm.exe and loaded later assemblies and a DLL into memory using .NET reflection.
Payload 4 created a Windows Run key for persistence and retrieved subsequent payloads through Telegram bot descriptions and URL shorteners.
The Python infostealer harvested browser credentials, cookies, credit-card data, and autofill data, then archived and sent the collected data through the Telegram Bot API.
PureRAT used an encrypted, certificate-pinned C2 connection and a tasking loop to receive and execute operator-supplied modules.
Defensive Notes: Use defense in depth across phishing protection, endpoint controls, and network monitoring; the article notes that no single control would stop the full chain.
Monitor for certutil.exe decoding activity, suspicious DLL sideloading, renamed Python interpreters, process hollowing involving RegAsm.exe, and unexpected registry Run-key creation.
Monitor for AMSI patching, ETW unhooking, suspicious WMI enumeration, and unexpected outbound traffic to Telegram or the reported C2 infrastructure.
Hunt for the reported payload hashes and isolate infected hosts; Huntress reports that its SOC isolated and remediated the affected host before additional PureRAT modules were deployed.

Indicators of compromise

Type	Indicator	Context
IPV4	`157[.]66[.]26[.]209`	PureRAT C2 server identified in the malware configuration; the article reports it was located in Vietnam.
SHA256	`06fc70aa08756a752546198ceb9770068a2776c5b898e5ff24af9ed4a823fd9d`	Hash of the Payload 8 loader.
SHA256	`f5e9e24886ec4c60f45690a0e34bae71d8a38d1c35eb04d02148cdb650dd2601`	Hash of the Payload 7 loader.
SHA256	`f6ed084aaa8ecf1b1e20dfa859e8f34c4c18b7ad7ac14dc189bc1fc4be1bd709`	Hash of the obfuscated Python script identified as Payload 2.
URL	`hxxps[:]//0x0[.]st/8WBr.py`	Stage 3 payload-hosting URL reported in the IOC table.
URL	`hxxps[:]//is[.]gd/s5xknuj2`	Shortened URL reported as hosting the Stage 2 payload.
URL	`hxxps[:]//paste[.]rs/fVmzS`	URL reported as hosting the Stage 2 payload.