# Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogs

> Active malspam campaign (July-August 2026, ITOCHU Cyber & Intelligence research) targets Japanese and Korean organizations with fake damaged-product, shipping, refund, and exchange complaint emails that redirect victims to fake document-sharing and video-viewing sites and deliver ZIP archives containing PureRAT (remote access trojan) or PureLogs (information stealer). Loaders vary per sample - DLL side-loading via a legitimate Microsoft-signed Excel.exe, double-extension EXEs, bundled Python interpreters, a customized Donut loader, in-memory execution, and one variant that abuses the signed but vulnerable Lenovo driver BootRepair.sys (BYOVD) to terminate security-product processes at kernel level.

- **Published:** 2026-09-25T00:00:00Z
- **Last reviewed:** 2026-09-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2652
- **ID:** TL-2026-2652
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between July 14 and July 31, 2026, ITOCHU Cyber & Intelligence Inc. (ITOCHUCI) observed a coordinated malspam campaign delivering the Pure family of malware (PureRAT remote-access trojan and PureLogs information stealer) to organizations, primarily in Japan and South Korea. Nine lure emails were observed, all framed as routine business complaints - delivered product damaged, exchange or refund requested, product unusable due to damage, damage during shipping - from Japanese and Korean display names (e.g., 山本 美桜, 안보경, 鈴木 陽菜) with senders appearing to be support@ addresses. The From domains (azuravenue.com, babiesolutions.com, bagsdar.com, banksgreenanimals.com, baoholaodongbaoanh.com, baoquocgiavn.com, baqtalanaqh.com, bartonaussies.com, bayareakajabe.com) are unrelated to the Reply-To addresses, which point to arbitrary Outlook/Hotmail accounts. A shared email platform links all messages: identical Feedback-ID SenderId (wy495j7p7q6bc), Content-Type boundaries matching the PHP Swift Mailer format (_=_swift_<UNIXTIME>_<HEX>_=_), and sending IPs concentrated in the 103.82.20.0/103.179.188.0-189.0/103.153.74.0-75.0 ranges. Korean-language emails share a distinct Feedback-ID bucket (ee722xtg6x1dc) within the same platform.

Delivery is two-stage. Emails link to landing pages impersonating document-sharing and video-viewing services (sharedocumentsystem.com, shareddocumentdrivehub.com, globaldocumentsharingcenter.com, documentcloudlink.com, customerreviewproduct.com, customersrespondedpositively.com, cloudflare.carriernetworks.top, plus two abused .co.nz hosts drive.careernetwork.co.nz and drbox.august-brokers.co.nz) that claim the file is too large to preview and prompt a ZIP download; the download button POSTs to create.php, which returns a JSON redirect to a ZIP hosted on Pixeldrain at the time of investigation. The pages switch UI language among Vietnamese, English, Chinese, Japanese, and Korean and hide the download button for mobile user agents, and the page source contains Vietnamese-language comments - a possible attribution signal toward a Vietnamese-speaking developer.

PureRAT delivery uses DLL side-loading through a legitimate Microsoft-signed binary: the ZIP contains Full_Unboxing_Process_Inspection_Record_2026_1412621.pdf.exe, a double-extension EXE that is actually a legitimate signed Excel.exe, paired with AppVIsvSubsystems64.dll, a hidden DLL masquerading as a Windows App-V component and padded to ~75 MB with junk overlay data to evade size-limited security tooling and sandboxes. The loader displays a decoy proforma_invoice.pdf, copies itself to %LOCALAPPDATA%\u53g9ujpaxy1\, establishes Startup-folder persistence (u53g9ujpaxy1.lnk), reconstructs shellcode from 175 RCDATA resources located via a CHRD marker, and executes a customized Donut loader modified so decryption targets sit at non-standard offsets (defeating donut-decryptor tooling). A .NET stage loads protobuf-net.dll and PayloadSource.zip from resources, decrypts it with TripleDES-CBC and GZip, and runs it via Assembly.Load. The extracted PureRAT configuration points to C2 tirakian.com on ports 56001/56002/56003 with an embedded certificate (CN=PureRAT Agent) and campaign ID 'bem'. PureRAT's initial beacon reports the security products installed, webcam presence, username/domain, OS version/architecture, idle time, active-window title, executable path, and a screenshot, and it steers data from browsers (Chrome, Brave, Edge, Vivaldi, Epic Privacy Browser, Comodo Dragon, CocCoc), cryptocurrency wallets (Atomic, Bitcoin-Qt, Dash-Qt, Electrum, Ethereum keystore, Exodus, Jaxx, Litecoin-Qt, Zcash), and messaging apps (Telegram Desktop, Foxmail).

PureLogs infection chains use four distinct loader variants to spread identical payloads across different hash-detection surfaces. Type 1 bundles a Python interpreter: the side-loaded DLL decrypts an RC4-encrypted PDF decoy, extracts an encrypted RAR to C:\Users\Public\WindowsUpdate, and runs Python, which XOR-decrypts instruction.pdf and launches a .NET PureLogs downloader. Type 2-1 uses a Donut loader fed by a rolling-XOR-encrypted funtsub.dat, with triple persistence - a WindowsFontCacheRestore scheduled task running a VBS via wscript.exe, Startup LNK/BAT shortcuts to the same VBS, and an HKCU Run key invoking regsvr32.exe /s on the DLL. Type 2-2 combines AMSI/ETW disabling with a rundll32.exe APIExportForDetours cross-process transfer, reads propsys_1f520a24.cache, XORs it with 0x85, extracts a bundled Python interpreter with tar.exe, and runs a scheduled task every minute that XORs trump.bin with 0xAA and executes it in memory. Type 3 performs process hollowing and Bring-Your-Own-Vulnerable-Driver (BYOVD): the uxtheme.dll loader executes XOR-encoded shellcode via process hollowing, drops the Lenovo-signed but vulnerable driver BootRepair.sys to C:\Users\Public\moimoi.sys, creates and starts a kernel service via 'sc create moimoi ... type= kernel', then sends security-product process PIDs to the driver over IOCTL 0x222014, which calls ZwTerminateProcess at SYSTEM privilege to kill EDR/AV processes. PureLogs then phones home to C2 domains (logs.uvexio.com, tea.vexexo.com, trump2.1368.lol, bdp.edu.vn, pure26.myftp.org) over HTTP endpoints (/ping, /plugin, /userinfo, /browser, /discord, /filesearch/req, /finish), tunneling data as 16-byte IV prepended to AES-256-CBC-encrypted GZip payloads.

The Pure family is a malware-as-a-service ecosystem sold by the operator 'PureCoder' (marketplace + Telegram support, ~$99/month to $499 lifetime, first offered 2022), and prior PureLogs/PureRAT campaigns have been tracked publicly (Check Point's 'Under the Pure Curtain', Securonix 'SERPENTINE#CLOUD', June 2025) with Vietnam-linked C2 infrastructure - consistent with the Vietnamese-language signals in this campaign. Notably, the same Microsoft-signed Excel.exe and the same PureLogs payloads were delivered through structurally different loaders, defeating hash-only detection; defenders should combine email-header analysis (sender/Reply-To mismatch, shared Feedback-ID, Swift Mailer fingerprints), endpoint behavior monitoring (DLL side-loading, AMSI/ETW disablement, kernel-driver service creation, IOCTL-driven process termination, VBS/Python execution), and infrastructure blocking of the published IOCs.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.006 Python
- T1059.007 JavaScript
- T1547.001 Registry Run Keys / Startup Folder
- T1547.009 Shortcut Modification
- T1053.005 Scheduled Task
- T1543.003 Windows Service
- T1574.001 DLL
- T1055.012 Process Hollowing
- T1027.001 Binary Padding
- T1036.008 Masquerade File Type
- T1685 Disable or Modify Tools
- T1497.001 System Checks
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1113 Screen Capture
- T1071.001 Web Protocols

## Sources

- [PureRAT・PureLogsを用いて日本の組織を標的とする攻撃キャンペーンの分析 (Japanese analysis)](https://blog.itochuci.co.jp/entry/2026/09/04/130000)
- [ITOCHU Cyber & Intelligence: PureRAT/PureLogs campaign analysis (English)](https://blog-en.itochuci.co.jp/entry/2026/09/25/090000)
- [Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines](https://cybersecuritynews.com/business-emails/)
- [Cyble: Pure_Coder Offers Multiple Malware For Sale In Darkweb Forums](https://cyble.com/pure-coder-offers-multiple-malware-for-sale-in-darkweb-forums/)
- [Flashpoint: PureLogs - Low-Cost Infostealer, High-Impact Threat](https://flashpoint.io/blog/purelogs-low-cost-infostealer-high-impact-threat/)
- [Huntress: PureRAT Threat Actor Evolution](https://www.huntress.com/blog/purerat-threat-actor-evolution)
- [BleepingComputer: From infostealer to full RAT - dissecting the PureRAT attack chain](https://www.bleepingcomputer.com/news/security/from-infostealer-to-full-rat-dissecting-the-purerat-attack-chain/)
- [Derp Research: PureLogs / PureRAT analysis (PXA-linked infrastructure)](https://www.derp.ca/research/plog-rat-analysis/)
- [MITRE ATT&CK: T1068 Exploitation for Privilege Escalation (BYOVD mapping)](https://attack.mitre.org/techniques/T1068/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2652