From infostealer to full RAT: dissecting the PureRAT attack chain

This Huntress Labs report dissects a layered phishing-to-RAT campaign that chained multiple in-memory Python loaders, a .NET process-hollowing loader, and reflective DLL loading to deliver PureRAT; it documents defensive evasion (AMSI/ETW bypass), credential and browser data theft via a Python stealer exfiltrated over Telegram, full RAT configuration (C2 IP 157.66.26.209, ports 56001–56003, TLS pinning), and provides IOCs, MITRE ATT&CK mapping, and attribution links to the PXA/PureCoder ecosystem.