PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5841 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PureRAT/PureLogs Signed Excel.exe DLL Side-Loading (AppVIsvSubsystems) and Double-Extension Launch

TL-2026-5841 PureRAT and PureLogs loaders ship a Microsoft-signed Excel.exe renamed with a double extension (for example .pdf.exe) that side-loads a padded AppVIsvSubsystems64.dll or AppVIsvSubsystems32.dll from the unzip directory. This search fires on the DLL being loaded from outside an Office Program Files install, or on a double-extension or renamed Excel.exe process launch. It is behaviour-first, so it still fires when loader hashes change between samples.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574.002, T1036.007, T1204.002, T1027.001
• Data sources: sysmon (EventCode 1 and 7, index=windows), microsoft_defender_for_endpoint (DeviceImageLoadEvents, DeviceProcessEvents)
• Severity: high
• Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=7 (ImageLoaded="*AppVIsvSubsystems64.dll" OR ImageLoaded="*AppVIsvSubsystems32.dll") NOT ImageLoaded="*Program Files*") OR (EventCode=1 (Image="*.pdf.exe" OR Image="*.mp4.exe" OR (OriginalFileName="Excel.exe" NOT Image="*Program Files*")))) | eval detection_signal=if(EventCode=7,"AppVIsvSubsystems DLL side-load outside Office path","Double-extension or renamed Excel.exe launch") | fillnull value="unknown" User Image | stats count min(_time) as first_seen max(_time) as last_seen values(ImageLoaded) as loaded_dll values(CommandLine) as cmdline values(ParentImage) as parent_image by host, User, Image, detection_signal | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

union
(DeviceImageLoadEvents
 | where Timestamp > ago(24h)
 | where FileName in~ ("AppVIsvSubsystems64.dll", "AppVIsvSubsystems32.dll")
 | where FolderPath !contains "Program Files"
 | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, ProcessName=InitiatingProcessFileName, ProcessPath=InitiatingProcessFolderPath, LoadedDll=FolderPath, SHA256, Signal="AppVIsvSubsystems DLL side-load outside Office path"),
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where FileName endswith ".pdf.exe" or FileName endswith ".mp4.exe" or (ProcessVersionInfoOriginalFileName =~ "Excel.exe" and FolderPath !contains "Program Files")
 | project Timestamp, DeviceName, AccountName, ProcessName=FileName, ProcessPath=FolderPath, LoadedDll="", SHA256, Signal="Double-extension or renamed Excel.exe launch")
| order by Timestamp desc

Sigma

title: PureRAT/PureLogs AppVIsvSubsystems DLL Side-Loaded Outside Office Install Path
id: 3f6c8a1e-5b0d-4e5a-9c1f-7a2d4b8e6c10
status: experimental
description: Detects loading of AppVIsvSubsystems64.dll or AppVIsvSubsystems32.dll from a location other than a Program Files Office install. The PureRAT and PureLogs campaign (TL-2026-5841) side-loads an oversized malicious copy through a Microsoft-signed Excel.exe renamed with a double extension such as .pdf.exe.
references:
  - https://blog-en.itochuci.co.jp/entry/2026/09/25/090000
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.defense-evasion
  - attack.execution
  - attack.t1574.002
  - attack.t1036.007
  - attack.t1204.002
  - attack.t1027.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - '\AppVIsvSubsystems64.dll'
      - '\AppVIsvSubsystems32.dll'
  filter_office_install:
    ImageLoaded|contains: '\Program Files'
  condition: selection and not filter_office_install
falsepositives:
  - Microsoft Office App-V clients installed in a non-standard directory
level: high

Known false positives:

• Office App-V components deployed outside Program Files by a software packaging team
• Software testers or packagers renaming Excel.exe for lab work

Tuning notes: Adjust the index name to your Sysmon index. Allow-list approved Office install roots (for example a C2R custom path) in the NOT clauses. Sysmon EventCode 7 must be enabled for image loads and scoped to avoid volume. Add a file-size check (DLL near 75 MB) where telemetry allows to raise fidelity.

• 🔒 PureRAT/PureLogs Phishing Delivery - Lure Domains, Sender IPs and Pixeldrain ZIP Download · unlock with TL Creds
• 🔒 PureRAT/PureLogs Persistence - WindowsFontCacheRestore Task, FontCacheSync.vbs, u53g9ujpaxy1 Startup and regsvr32 Run Key · unlock with TL Creds
• 🔒 PureLogs C2 - Known Infrastructure and /filesearch/req Endpoint · unlock with TL Creds
• 🔒 PureLogs Type 2-2 Loader - rundll32 APIExportForDetours, [indicator] and Public WindowsUpdate Python Runtime · unlock with TL Creds
• 🔒 PureLogs Type 3 - uxtheme.dll Side-Loaded from Non-System Path (Process Hollowing Loader) · unlock with TL Creds
• 🔒 PureRAT and PureLogs C2 DNS Resolution of Known Campaign Domains · unlock with TL Creds
• 🔒 PureLogs Type 3 BYOVD - BootRepair.sys Loaded as moimoi Kernel Service · unlock with TL Creds
• 🔒 PureRAT C2 Beaconing - [indicator] and TCP 56001-56003 · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 47 indicators of compromise for TL-2026-5841.

Sample indicators (3 of 47)

• IP address: 103.153.74[.]201
• Domain: tirakian[.]com
• File hash: 2e05d97ed7bfabea8f7370ba627e0705ec2c0fbf3974b39437e9d95d45d1a76d

Defanged, TLP:CLEAR. Full set of 47 indicators: unlock with TL Creds.

Community OSINT corroboration

8 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

The source states no threat actor attribution.

Phishing emails written in Japanese and Korean pose as customer complaints about damaged products or refund/exchange requests, and tell the recipient to review an "unboxing" video or photos through a link. Nine subject lines were observed (for example "The delivered product is damaged" and "Please arrange an exchange or refund"). The mails were sent from support@ addresses on throwaway domains (azuravenue.com, babiesolutions.com, bagsdar.com, banksgreenanimals.com, baoholaodongbaoanh.com, baoquocgiavn.com, baqtalanaqh.com, bartonaussies.com, bayareakajabe.com), with Outlook/Hotmail Reply-To addresses and sender IPs in 103.153.x, 103.82.x and 103.179.x ranges. HELO hosts follow an apiMMDD.<domain> pattern. Email Date headers span 14 July to 31 July 2026 (14, 15, 20, 27, 28 x3, 30 and 31 July). The mail headers match the PHP Swift Mailer boundary format (_=_swift_<UNIXTIME>_<HEX>_=_) and share Feedback-ID values whose final field is constant (wy495j7p7q6bc), with separate values for Japanese and Korean mails. The links lead to pages that impersonate document-sharing or video-viewing services (sharedocumentsystem.com, shareddocumentdrivehub.com, globaldocumentsharingcenter.com, documentcloudlink.com, customerreviewproduct.com, customersrespondedpositively.com, plus compromised-looking subdomains on careernetwork.co.nz and august-brokers.co.nz and cloudflare.carriernetworks.top). The pages offer Vietnamese, English, Chinese, Japanese and Korean language options (with Vietnamese comments in the page source), claim the file is too large to preview, and post to a create.php endpoint that returns JSON redirecting to a ZIP download. The ZIPs were hosted on Pixeldrain. Mobile visitors are told the file cannot be downloaded on a phone.

The ZIP holds an EXE with a double extension (for example .pdf.exe), which is a legitimately Microsoft-signed Excel.exe, plus a hidden DLL, usually AppVIsvSubsystems64.dll (a 32-bit AppVIsvSubsystems32.dll appears in Type 1), that Excel.exe side-loads. The DLL is padded to roughly 75 MB with unrelated overlay data. The loader differs by variant. In the PureRAT variant the DLL shows a decoy PDF (proforma_invoice.pdf), copies itself to %LOCALAPPDATA%\u53g9ujpaxy1\, creates a Startup shortcut, and reassembles shellcode from 175 RCDATA resources (marker CHRD, configuration in resource ID 4000). That shellcode is a modified Donut loader whose encrypted data sits at a non-standard offset, which defeated existing Donut decryptors. It unpacks a .NET loader that decrypts PayloadSource.zip (TripleDES-CBC, then GZip) and loads PureRAT with Assembly.Load (protobuf-net.dll is among the resources). PureRAT beacons to tirakian.com on TCP 56001-56003 with campaign ID "bem" and an embedded certificate with Subject and Issuer CN=PureRAT Agent. On first contact it sends the security product name, webcam presence, user and domain name, OS version, idle time, active window title, executable path and a screenshot, and it steals data from browsers, crypto wallets (Atomic, Bitcoin-Qt, Electrum, Exodus and others) and messaging/mail clients (Telegram Desktop, Foxmail).

PureLogs is delivered by several loader types. Type 1 decrypts an RC4-encrypted decoy document, extracts an encrypted RAR to C:\Users\Public\WindowsUpdate and runs a bundled Python runtime that XOR-decrypts instruction.pdf and launches a .NET PureLogs downloader. Type 2-1 loads funtsub.dat (rolling XOR, Donut shellcode) and persists with a scheduled task WindowsFontCacheRestore running wscript.exe on FontCacheSync.vbs, a Startup LNK/BAT, and an HKCU Run key using regsvr32.exe /s. Type 2-2 runs rundll32.exe on the DLL export APIExportForDetours, disables AMSI and ETW, performs anti-debugging and anti-sandbox checks, reads propsys_1f520a24.cache up to the LABRUN marker, XORs with 0x85, extracts a ZIP with tar.exe, and runs a Python script every minute via a scheduled task that XOR-decodes trump.bin (0xAA) in memory as a Donut loader for PureLogs. Type 3 uses a side-loaded uxtheme.dll that XOR-decodes shellcode and injects it by process hollowing, then performs BYOVD: it drops the Lenovo-signed BootRepair.sys as C:\Users\Public\moimoi.sys, creates and starts a kernel service named moimoi (cmd.exe /c sc create moimoi binPath= C:\Users\Public\moimoi.sys type= kernel & sc start moimoi), and sends IOCTL 0x222014 with a target PID so the driver calls ZwTerminateProcess to kill security-product processes. It then downloads more Donut shellcode from C2 carrying PureLogs. The source does not name the hollowing target process or list the security products terminated.

PureLogs communicates over HTTP endpoints GET /ping and POST /plugin, /userinfo, /browser, /discord, /filesearch/req and /finish, with payloads encrypted as a 16-byte IV followed by AES-256-CBC over GZip data. It collects system information and screenshots, browser cookies and profiles, Discord data and file-search results, and fetches plugins. Because the payloads stay the same while loaders change, hash- and pattern-based defenses may miss new variants, and ITOCHU expects further loader changes. The source notes the Vietnamese comments and the Japan/Korea targeting but draws no attribution. Separate Cyderes (Howler Cell) reporting links PureRAT and PureLogs to the PureCoder malware-as-a-service suite, but that is about the malware family, not this campaign's operator.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.001 Binary Padding; T1036.007 Double File Extension; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1218.010 Regsvr32; T1218.011 Rundll32; T1497.001 System Checks; T1574.001 DLL; T1620 Reflective Code Loading; T1622 Debugger Evasion

Persistence

T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.005 Visual Basic; T1059.006 Python; T1204.001 Malicious Link; T1204.002 Malicious File

Discovery

T1082 System Information Discovery; T1518.001 Security Software Discovery

Collection

T1113 Screen Capture

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• No CVE is assigned; apply driver blocklist updates covering BootRepair.sys (SHA-256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946)

Immediate actions

• Block the listed domains (tirakian.com, shareddocumentdrivehub.com, globaldocumentsharingcenter.com, sharedocumentsystem.com, documentcloudlink.com, customerreviewproduct.com, customersrespondedpositively.com, logs.uvexio.com, tea.vexexo.com, trump2.1368.lol, pure26.myftp.org) and TCP 56001-56003 egress at proxy/DNS/firewall
• Block the sender IPs and filter mail with a From/Reply-To mismatch, Swift Mailer boundary pattern and unboxing/damaged-product/refund subject lines
• Hunt for BootRepair.sys, the kernel service 'moimoi', C:\Users\Public\moimoi.sys and C:\Users\Public\WindowsUpdate
• Isolate affected endpoints and reset credentials and sessions for users whose browsers, crypto wallets or messaging apps may have been accessed

Workarounds

• Block ZIP downloads from file-sharing hosts such as Pixeldrain for corporate users where business needs allow
• Show file extensions and warn users about double-extension files (.pdf.exe)

Longer-term hardening

• Enable the Microsoft vulnerable driver blocklist / HVCI and WDAC rules to block known-vulnerable signed drivers such as BootRepair.sys
• Alert on signed Office binaries (Excel.exe) executing from user-writable or archive-extracted paths and loading unsigned DLLs
• Restrict or alert on portable Python runtimes, wscript.exe, rundll32.exe and regsvr32.exe launched from user profile or Public folders
• Do not rely on hash-only detection: loaders change between samples while payloads stay constant

Affected and fixed versions

• Microsoft — Windows (endpoints of Japanese and Korean organizations)
  Vulnerable versions: Not specified in source
• Lenovo — BootRepair.sys signed driver (abused for BYOVD)
  Vulnerable versions: Version not specified in source

Timeline

• 2026-07-14 Earliest observed phishing email (Date header 14 Jul 2026 03:37:51 UTC): Japanese/Korean damaged-product and refund lures linking to fake document-sharing pages.
• 2026-07-15 Second observed phishing email (Date header 15 Jul 2026 03:05:34 UTC), sent from a different throwaway sender domain with the same Swift Mailer pattern.
• 2026-07-20 Observed phishing email dated 20 Jul 2026 02:59:51 UTC from another throwaway support@ domain.
• 2026-07-27 Observed phishing email dated 27 Jul 2026 07:42:20 UTC, sent from a 103.179.x sender IP.
• 2026-07-28 Three phishing emails observed on 28 Jul 2026 (02:23, 06:01 and 08:44 UTC) from distinct sender domains and 103.179.x/103.82.x IPs.
• 2026-07-30 Observed phishing email dated 30 Jul 2026 03:21:22 UTC.
• 2026-07-31 Latest observed phishing email (31 Jul 2026 03:10:31 UTC); ITOCHU reports campaign activity across July-August 2026 with PureRAT and several PureLogs loader variants.
• 2026-09-04 ITOCHU Cyber & Intelligence published the Japanese-language version of its analysis of the campaign.
• 2026-09-25 SOC Prime published an active-threat page with detection content and hunting guidance for the campaign.
• 2026-09-25 ITOCHU Cyber & Intelligence published the English analysis detailing loader types, Donut modifications, BYOVD with BootRepair.sys and IOCs.

Sources cited

• Job offer attack chains analysis (Cyderes Howler Cell, PureRAT/PureLogs background) cyderes.com · Research
• MITRE ATT&CK T1068 Exploitation for Privilege Escalation (cited by ITOCHU for BYOVD) MITRE · Research
• MITRE ATT&CK T1574.002 DLL Side-Loading MITRE · Research
• MITRE ATT&CK T1055.012 Process Hollowing MITRE · Research
• Volexity donut-decryptor (tool that failed against the modified Donut loader) GitHub · Code repository
• PureRAT and PureLogs Campaign Targeting Japanese Organizations (ITOCHU Cyber & Intelligence) blog-en.itochuci.co.jp · Blog · 2026-09-25
• PureRAT and PureLogs Campaign Targeting Japanese Organizations (SOC Prime active threats) socprime.com · Blog · 2026-09-25

More in malware

• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)
• Falcon (XG / Xiàng Gē) Browser-Based C2 Framework and Antino Implant Targeting Government Webmail and Web Applications

Further reading

• Japanese Phishing Spoofs ANA, DHL, myTOKYOGAS