PureRAT Unmasked: The Stealthy, Multi-Stage “Dynamic Loader” Targeting Windows

Trellix ARC's analysis describes PureRAT as a sophisticated, modular remote access trojan that uses a deceptive LNK to run concealed PowerShell which fetches an obfuscated VBS loader; the malware hides malicious PE files inside PNG images via steganography for fileless in-memory execution, employs UAC bypass (cmstp.exe), process hollowing (msbuild.exe), anti-VM checks, and implements modules for credential harvesting, audio/video monitoring and remote desktop, with persistence and a C2 at instantservices1.ddnsguru.com.