Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogs

Key facts

Detection coverage

As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2652 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PureRAT/PureLogs Loader — AppV DLL Side-Load and Double-Extension Execution (Post-Exploitation)

Detects the loader execution stage of PureRAT/PureLogs delivery: (1) execution of double-extension files (.pdf.exe/.docx.exe/.xlsx.exe/.jpg.exe) such as Full_Unboxing_Process_Inspection_Record_2026_1412621.pdf.exe, (2) Sysmon image-load events for the hidden AppVIsvSubsystems64.dll / AppVIsvSubsystems32.dll masquerading DLLs (SHA-256 e5541255...) that the legitimate Microsoft-signed Excel.exe side-loads, and (3) the known abused signed Excel.exe hash 2e05d97e... reused across the whole campaign. The DLL is padded to ~75 MB with junk overlay (binary padding) to defeat size-limited sandboxing.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574.002, T1036.008, T1027.001
• Data sources: sysmon, windows_process_creation, edr_image_load
• Severity: high
• Confidence: high

Splunk SPL

(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-14d (CommandLine="*.pdf.exe*" OR CommandLine="*.docx.exe*" OR CommandLine="*.xlsx.exe*" OR CommandLine="*.jpg.exe*"))
OR (index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 earliest=-14d (ImageLoaded="*AppVIsvSubsystems64.dll" OR ImageLoaded="*AppVIsvSubsystems32.dll" OR Hashes="*e55412555b4699c6d3ce2ac60df81eb1ee0d5aa412a303555c8f64037d5633d0*"))
OR (index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-14d Hashes="*2e05d97ed7bfabea8f7370ba627e0705ec2c0fbf3974b39437e9d95d45d1a76d*")
| eval detector=case(EventCode==1 AND like(CommandLine,"%.pdf.exe%"),"double-extension .pdf.exe execution",EventCode==1 AND (like(CommandLine,"%.docx.exe%") OR like(CommandLine,"%.xlsx.exe%") OR like(CommandLine,"%.jpg.exe%")),"double-extension execution",EventCode==7 AND (like(ImageLoaded,"%AppVIsvSubsystems64.dll") OR like(ImageLoaded,"%AppVIsvSubsystems32.dll")),"AppV DLL side-load masquerade",EventCode==7,"known PureRAT loader DLL hash (e5541255...)",EventCode==1,"known Full_Unboxing Excel.exe hash (2e05d97e...)",1=1,"other")
| where detector!="other"
| stats count as hits, earliest(_time) as first_seen, latest(_time) as last_seen, values(CommandLine) as cmdlines, values(ImageLoaded) as side_loaded_dlls by Computer, User, detector
| table first_seen last_seen Computer User detector hits cmdlines side_loaded_dlls
| sort - hits

Microsoft KQL

let AppVDlls = dynamic(["appvisvsubsystems64.dll", "appvisvsubsystems32.dll"]);
let OfficeDirs = dynamic([@"C:\Program Files\Microsoft Office", @"C:\Program Files (x86)\Microsoft Office"]);
DeviceImageLoadEvents
| where Timestamp > ago(14d)
| where FileName in~ (AppVDlls) or (InitiatingProcessFileName =~ "excel.exe" and not(FolderPath has_any (OfficeDirs)))
| extend MatchedIndicator = iff(FileName in~ (AppVDlls), "AppV_sideload_DLL", "excel.exe_sideloading_outside_Office")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, MatchedIndicator
| order by Timestamp desc

Sigma

title: PureCoder Loader - AppVIsvSubsystems DLL Side-Load / Double-Extension Execution
id: a3c51f7b-2e8d-4c1b-9e04-7f2a9b3d5c12
status: experimental
description: Detects DLL side-loading of the hidden AppVIsvSubsystems64.dll/AppVIsvSubsystems32.dll masquerading DLLs into image load chains or execution of double-extension (.pdf.exe/.docx.exe/.xlsx.exe/.jpg.exe) files, signatures of the PureRAT/PureLogs delivery loaders that abuse a legitimate Microsoft-signed Excel.exe (ITOCHUCI, Jul-Aug 2026).
references:
    - https://blog-en.itochuci.co.jp/entry/2026/09/25/090000
author: Threadlinqs Team
date: 2026/09/25
tags:
    - attack.persistence
    - attack.t1574.002
    - attack.defense_evasion
    - attack.t1036.008
    - attack.t1027.001
    - attack.tool.purerat
    - attack.tool.purelogs
logsource:
    category: image_load
    product: windows
detection:
    selection_appv_dll:
        ImageLoaded|endswith:
            - 'AppVIsvSubsystems64.dll'
            - 'AppVIsvSubsystems32.dll'
    selection_double_ext:
        Image|endswith:
            - '.pdf.exe'
            - '.docx.exe'
            - '.xlsx.exe'
            - '.jpg.exe'
    condition: selection_appv_dll or selection_double_ext
falsepositives:
    - Genuine Microsoft App-V (Application Virtualization) components loading their own AppVIsvSubsystems* DLLs from the App-V installation directory
level: high

Known false positives:

• Legitimate Microsoft App-V client loading AppVIsvSubsystems*.dll from the official App-V install path
• Developers/QA running signed Office binaries renamed for testing

Tuning notes: Add a filter excluding the genuine App-V installation directory (e.g., C:\Program Files\Microsoft Application Virtualization) to suppress the true-positive-of-benign App-V DLLs. File-size threshold: flag AppVIsvSubsystems64.dll instances larger than ~50 MB (junk-overlay padding). Correlate with Sysmon EventCode 11 writes to %LOCALAPPDATA%\u53g9ujpaxy1\ to catch the loader staging directory.

• 🔒 PureCoder Lure Phishing — Document-Sharing/Video Look-alike Site Access and ZIP/EXE Download (Exploitation) · unlock with TL Creds
• 🔒 PureCoder Loader Persistence — Run Key regsvr32, WindowsFontCacheRestore Task, Startup LNK, wscript VBS, Python Bundle (Post-Exploitation) · unlock with TL Creds
• 🔒 PureLogs Info-Stealer — Browser/Wallet/Messenger Credential Sweep with C2 Contact (C2 / Exfiltration) · unlock with TL Creds
• 🔒 PureCoder Malspam — Swift Mailer / Shared Feedback-ID Business-Complaint Lure (Exploitation) · unlock with TL Creds
• 🔒 PureCoder BYOVD — Kernel Driver Service Creation via BootRepair.sys (moimoi) Killing EDR/AV (Post-Exploitation) · unlock with TL Creds
• 🔒 PureRAT/PureLogs C2 — Network Connection to Known C2 Domains, Sibling Hosting IPs, or Beacon Ports 56001-56003 (C2) · unlock with TL Creds
• 🔒 PureCoder Malspam — Business-Complaint Lure Email (Shared Feedback-ID / Swift Mailer / Reply-To Mismatch, Exploitation) · unlock with TL Creds
• 🔒 PureRAT / PureLogs C2 Beacon — [indicator]:56001-56003, PureLogs HTTP API, Sibling C2 IPs (C2) · unlock with TL Creds

Indicators of compromise

As of 2026-09-25, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-2652.

Sample indicators (3 of 31)

• IP address: 103.153.74[.]201
• Domain: sharedocumentsystem[.]com
• File hash: 2e05d97ed7bfabea8f7370ba627e0705ec2c0fbf3974b39437e9d95d45d1a76d

Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.

Community OSINT corroboration

8 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Loaders vary per sample - DLL side-loading via a legitimate Microsoft-signed Excel.exe, double-extension EXEs, bundled Python interpreters, a customized Donut loader, in-memory execution, and one variant that abuses the signed but vulnerable Lenovo driver BootRepair.sys (BYOVD) to terminate security-product processes at kernel level.

Between July 14 and July 31, 2026, ITOCHU Cyber & Intelligence Inc. (ITOCHUCI) observed a coordinated malspam campaign delivering the Pure family of malware (PureRAT remote-access trojan and PureLogs information stealer) to organizations, primarily in Japan and South Korea. Nine lure emails were observed, all framed as routine business complaints - delivered product damaged, exchange or refund requested, product unusable due to damage, damage during shipping - from Japanese and Korean display names (e.g., 山本 美桜, 안보경, 鈴木 陽菜) with senders appearing to be support@ addresses. The From domains (azuravenue.com, babiesolutions.com, bagsdar.com, banksgreenanimals.com, baoholaodongbaoanh.com, baoquocgiavn.com, baqtalanaqh.com, bartonaussies.com, bayareakajabe.com) are unrelated to the Reply-To addresses, which point to arbitrary Outlook/Hotmail accounts. A shared email platform links all messages: identical Feedback-ID SenderId (wy495j7p7q6bc), Content-Type boundaries matching the PHP Swift Mailer format (_=_swift_<UNIXTIME>_<HEX>_=_), and sending IPs concentrated in the 103.82.20.0/103.179.188.0-189.0/103.153.74.0-75.0 ranges. Korean-language emails share a distinct Feedback-ID bucket (ee722xtg6x1dc) within the same platform.

Delivery is two-stage. Emails link to landing pages impersonating document-sharing and video-viewing services (sharedocumentsystem.com, shareddocumentdrivehub.com, globaldocumentsharingcenter.com, documentcloudlink.com, customerreviewproduct.com, customersrespondedpositively.com, cloudflare.carriernetworks.top, plus two abused .co.nz hosts drive.careernetwork.co.nz and drbox.august-brokers.co.nz) that claim the file is too large to preview and prompt a ZIP download; the download button POSTs to create.php, which returns a JSON redirect to a ZIP hosted on Pixeldrain at the time of investigation. The pages switch UI language among Vietnamese, English, Chinese, Japanese, and Korean and hide the download button for mobile user agents, and the page source contains Vietnamese-language comments - a possible attribution signal toward a Vietnamese-speaking developer.

PureRAT delivery uses DLL side-loading through a legitimate Microsoft-signed binary: the ZIP contains Full_Unboxing_Process_Inspection_Record_2026_1412621.pdf.exe, a double-extension EXE that is actually a legitimate signed Excel.exe, paired with AppVIsvSubsystems64.dll, a hidden DLL masquerading as a Windows App-V component and padded to ~75 MB with junk overlay data to evade size-limited security tooling and sandboxes. The loader displays a decoy proforma_invoice.pdf, copies itself to %LOCALAPPDATA%\u53g9ujpaxy1\, establishes Startup-folder persistence (u53g9ujpaxy1.lnk), reconstructs shellcode from 175 RCDATA resources located via a CHRD marker, and executes a customized Donut loader modified so decryption targets sit at non-standard offsets (defeating donut-decryptor tooling). A .NET stage loads protobuf-net.dll and PayloadSource.zip from resources, decrypts it with TripleDES-CBC and GZip, and runs it via Assembly.Load. The extracted PureRAT configuration points to C2 tirakian.com on ports 56001/56002/56003 with an embedded certificate (CN=PureRAT Agent) and campaign ID 'bem'. PureRAT's initial beacon reports the security products installed, webcam presence, username/domain, OS version/architecture, idle time, active-window title, executable path, and a screenshot, and it steers data from browsers (Chrome, Brave, Edge, Vivaldi, Epic Privacy Browser, Comodo Dragon, CocCoc), cryptocurrency wallets (Atomic, Bitcoin-Qt, Dash-Qt, Electrum, Ethereum keystore, Exodus, Jaxx, Litecoin-Qt, Zcash), and messaging apps (Telegram Desktop, Foxmail).

PureLogs infection chains use four distinct loader variants to spread identical payloads across different hash-detection surfaces. Type 1 bundles a Python interpreter: the side-loaded DLL decrypts an RC4-encrypted PDF decoy, extracts an encrypted RAR to C:\Users\Public\WindowsUpdate, and runs Python, which XOR-decrypts instruction.pdf and launches a .NET PureLogs downloader. Type 2-1 uses a Donut loader fed by a rolling-XOR-encrypted funtsub.dat, with triple persistence - a WindowsFontCacheRestore scheduled task running a VBS via wscript.exe, Startup LNK/BAT shortcuts to the same VBS, and an HKCU Run key invoking regsvr32.exe /s on the DLL. Type 2-2 combines AMSI/ETW disabling with a rundll32.exe APIExportForDetours cross-process transfer, reads propsys_1f520a24.cache, XORs it with 0x85, extracts a bundled Python interpreter with tar.exe, and runs a scheduled task every minute that XORs trump.bin with 0xAA and executes it in memory. Type 3 performs process hollowing and Bring-Your-Own-Vulnerable-Driver (BYOVD): the uxtheme.dll loader executes XOR-encoded shellcode via process hollowing, drops the Lenovo-signed but vulnerable driver BootRepair.sys to C:\Users\Public\moimoi.sys, creates and starts a kernel service via 'sc create moimoi ... type= kernel', then sends security-product process PIDs to the driver over IOCTL 0x222014, which calls ZwTerminateProcess at SYSTEM privilege to kill EDR/AV processes. PureLogs then phones home to C2 domains (logs.uvexio.com, tea.vexexo.com, trump2.1368.lol, bdp.edu.vn, pure26.myftp.org) over HTTP endpoints (/ping, /plugin, /userinfo, /browser, /discord, /filesearch/req, /finish), tunneling data as 16-byte IV prepended to AES-256-CBC-encrypted GZip payloads.

The Pure family is a malware-as-a-service ecosystem sold by the operator 'PureCoder' (marketplace + Telegram support, ~$99/month to $499 lifetime, first offered 2022), and prior PureLogs/PureRAT campaigns have been tracked publicly (Check Point's 'Under the Pure Curtain', Securonix 'SERPENTINE#CLOUD', June 2025) with Vietnam-linked C2 infrastructure - consistent with the Vietnamese-language signals in this campaign. Notably, the same Microsoft-signed Excel.exe and the same PureLogs payloads were delivered through structurally different loaders, defeating hash-only detection; defenders should combine email-header analysis (sender/Reply-To mismatch, shared Feedback-ID, Swift Mailer fingerprints), endpoint behavior monitoring (DLL side-loading, AMSI/ETW disablement, kernel-driver service creation, IOCTL-driven process termination, VBS/Python execution), and infrastructure blocking of the published IOCs.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.001 Binary Padding; T1036.008 Masquerade File Type; T1055.012 Process Hollowing; T1497.001 System Checks

Persistence

T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder; T1547.009 Shortcut Modification

Execution

T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols

Discovery

T1082 System Information Discovery; T1518.001 Security Software Discovery

Collection

T1113 Screen Capture

Credential Access

T1555.003 Credentials from Web Browsers

Initial Access

T1566.002 Spearphishing Link

stealth

T1574.001 DLL

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• No vendor CVE applies to this campaign; primary remediation is driver blocklisting and signature/behavior coverage of PureRAT and PureLogs
• Remove or blocklist the obsolete Lenovo-signed BootRepair utility driver used in the BYOVD stage per device-hygiene guidance for signed vulnerable drivers

Immediate actions

• Block the published lure domains, C2 domains, and 103.82.20.0-103.82.20.60 / 103.179.188.0-103.179.189.169 / 103.153.74.0-103.153.75.0 sending ranges at perimeter, DNS, and email gateways
• Quarantine emails whose Reply-To differs from the visible sender domain, share Feedback-ID SenderId wy495j7p7q6bc, or carry Swift Mailer _=_swift_ boundary fingerprints
• Hunt for AppVIsvSubsystems64.dll / AppVIsvSubsystems32.dll side-loading events, startup shortcuts written under the Startup folder, and %LOCALAPPDATA% cache-like directories
• Alert on creation of kernel driver services (sc create ... type= kernel), new services named moimoi, and IOCTL-driven process termination events
• Block execution of double-extension (.pdf.exe) attachments/archives and files downloaded via Mark-of-the-Web from document-sharing lookalike domains

Workarounds

• Verify unexpected damaged-product, refund, or exchange requests via a separate trusted channel (phone, official portal)
• Disable or prompt on execution of files with double extensions and of archives prompting 'too large to preview' downloads from unknown sharing sites
• Restrict execution of wscript.exe, regsvr32.exe, and Python interpreters via software restriction / WDAC for standard users

Longer-term hardening

• Deploy EDR with behavioral detection for process hollowing, DONUT-style in-memory shellcode, AMSI/ETW disablement, and unusual wscript.exe/regsvr32.exe/rundll32.exe usage
• Apply and maintain a Microsoft Vulnerable Driver Blocklist / WDAC policy covering BootRepair.sys (SHA-256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946)
• Enforce application control restricting bundled Python interpreters, wscript, and regsvr32 for non-administrative users
• Educate customer-facing staff (e-commerce, retail, logistics) to verify refund/exchange/shipping complaints through trusted channels rather than email links

Affected and fixed versions

• Microsoft — Microsoft Excel (signed binary abused for DLL side-loading)
  Fixed in: Not a product vulnerability - signed binary abuse
• Lenovo — BootRepair.sys utility driver (BYOVD target)
  Vulnerable versions: Signed versions of the BootRepair utility driver
  Fixed in: Remove/blocklist; no user-facing patch

Timeline

• 2026-07-14 First Japanese malspam observed (damaged-product complaint from display name 山本 美桜, sender support@azuravenue.com); Swift Mailer boundary timestamp 2026-07-14 03:37:51 UTC
• 2026-07-15 Second Japanese email (exchange/refund request) sent 03:05:34 UTC from support@babiesolutions.com via the shared sending platform (Feedback-ID SenderId wy495j7p7q6bc)
• 2026-07-20 First Korean-language email observed (product unusable due to damage, display name 안보경); Korean lanes share a distinct Feedback-ID bucket (ee722xtg6x1dc)
• 2026-07-27 Korean shipping-damage complaint email; lure pages serve multilingual (Vietnamese/English/Chinese/Japanese/Korean) UI with Vietnamese-language source comments
• 2026-07-28 Three emails in a single day (Japanese and Korean) as operators rotate loader implementations (Python, Donut, in-memory, BYOVD variants) against hash-based detection
• 2026-07-30 Refund-consideration email (Japanese, display name 佐藤 結衣, sender support@bartonaussies.com)
• 2026-07-31 Final observed wave of the July campaign (damaged-product check, display name 吉田 遥, sender support@bayareakajabe.com); ITOCHUCI observed the campaign through July-August 2026
• 2026-08-31 ITOCHU Cyber & Intelligence closes its July-August observation window with the campaign still active; same PureLogs payload delivered via four different loader families
• 2026-09-04 ITOCHU Cyber & Intelligence Inc. publishes full Japanese-language technical analysis with lure emails, loader internals, extraction results, and IOCs (blog.itochuci.co.jp)
• 2026-09-25 English-language ITOCHUCI report (blog-en.itochuci.co.jp) and Cyber Security News coverage ('Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines') publish

Sources cited

• PureRAT・PureLogsを用いて日本の組織を標的とする攻撃キャンペーンの分析 (Japanese analysis) blog.itochuci.co.jp · Research · 2026-09-04
• ITOCHU Cyber & Intelligence: PureRAT/PureLogs campaign analysis (English) blog-en.itochuci.co.jp · Research · 2026-09-25
• Cyble: Pure_Coder Offers Multiple Malware For Sale In Darkweb Forums cyble.com · Research · 2023-01-01
• Flashpoint: PureLogs - Low-Cost Infostealer, High-Impact Threat flashpoint.io · Research · 2024-01-01
• Derp Research: PureLogs / PureRAT analysis (PXA-linked infrastructure) derp.ca · Research · 2025-01-01
• MITRE ATT&CK: T1068 Exploitation for Privilege Escalation (BYOVD mapping) MITRE · Research · 2026-01-01
• Huntress: PureRAT Threat Actor Evolution Huntress · Blog · 2025-01-01
• Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines cybersecuritynews.com · News · 2026-09-25
• BleepingComputer: From infostealer to full RAT - dissecting the PureRAT attack chain BleepingComputer · News · 2025-01-01

More in malware

• PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)

Previous and next in malware

• Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and diverse loaders (DLL side-loading, Donut, Python, process hollowing, BYOVD) Previous report
• Deceptive Android Apps Exploit Google Play Early Access to Reach Mobile Users Next report