@james_inthe_box@infosec.exchange
Post #3538803
2026-07-02 12:50 UTC
Fresh #purerat :
https://app.any.run/tasks/4bd07f35-3a29-477a-8e2b-7e4d31182cd7
cc @da_667@infosec.exchange
Replies (2)
-
@da_667@infosec.exchange 2026-07-02 17:04
@james_inthe_box@infosec.exchange thanks for this. Threw together a quick rule to spot the certificate issuer. Should be in today's ETOPEN release PureRAT TLS Certificate Observed (PureRAT Agent)
-
@netresec@infosec.exchange 2026-07-03 18:33
@james_inthe_box@infosec.exchange @da_667@infosec.exchange FlowCarp classifies 104.249.10.71:2555 as #PureRAT inside of TLS Feel free to verify with: curl -s --data-binary @4bd07f35-3a29-477a-8e2b-7e4d31182cd7.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]'