Post #4244201
2026-07-30 15:09 UTC
The broken TLS implementation in PureRAT has been described in our blog post PureRAT = ResolverRAT = PureHVNC. Examples of such broken TLS traffic to 196.251.86.238:56001 can be found on JoeSandbox and ANY.RUN.
Replies (1)
-
@netresec@infosec.exchange 2026-07-30 15:14
More on why you shouldn't use the label/tag zgRAT https://netresec.com/?b=267e877