# PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)

> A July-August 2026 phishing campaign against Japanese (and Korean-language) targets, documented by ITOCHU Cyber & Intelligence, delivers the PureRAT remote access trojan and PureLogs infostealer through DLL side-loading of a Microsoft-signed Excel.exe and a modified Donut loader. One variant abuses the Lenovo-signed vulnerable driver BootRepair.sys (BYOVD) to terminate security products. The source states no threat actor attribution.

- **Published:** 2026-11-12T08:56:06Z
- **Last reviewed:** 2026-11-12T08:56:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5841
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5841.png
- **ID:** TL-2026-5841
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 47 (3 shown free below)

## Description

Phishing emails written in Japanese and Korean pose as customer complaints about damaged products or refund/exchange requests, and tell the recipient to review an "unboxing" video or photos through a link. Nine subject lines were observed (for example "The delivered product is damaged" and "Please arrange an exchange or refund"). The mails were sent from support@ addresses on throwaway domains (azuravenue.com, babiesolutions.com, bagsdar.com, banksgreenanimals.com, baoholaodongbaoanh.com, baoquocgiavn.com, baqtalanaqh.com, bartonaussies.com, bayareakajabe.com), with Outlook/Hotmail Reply-To addresses and sender IPs in 103.153.x, 103.82.x and 103.179.x ranges. HELO hosts follow an apiMMDD.<domain> pattern. Email Date headers span 14 July to 31 July 2026 (14, 15, 20, 27, 28 x3, 30 and 31 July). The mail headers match the PHP Swift Mailer boundary format (_=_swift_<UNIXTIME>_<HEX>_=_) and share Feedback-ID values whose final field is constant (wy495j7p7q6bc), with separate values for Japanese and Korean mails. The links lead to pages that impersonate document-sharing or video-viewing services (sharedocumentsystem.com, shareddocumentdrivehub.com, globaldocumentsharingcenter.com, documentcloudlink.com, customerreviewproduct.com, customersrespondedpositively.com, plus compromised-looking subdomains on careernetwork.co.nz and august-brokers.co.nz and cloudflare.carriernetworks.top). The pages offer Vietnamese, English, Chinese, Japanese and Korean language options (with Vietnamese comments in the page source), claim the file is too large to preview, and post to a create.php endpoint that returns JSON redirecting to a ZIP download. The ZIPs were hosted on Pixeldrain. Mobile visitors are told the file cannot be downloaded on a phone.

The ZIP holds an EXE with a double extension (for example .pdf.exe), which is a legitimately Microsoft-signed Excel.exe, plus a hidden DLL, usually AppVIsvSubsystems64.dll (a 32-bit AppVIsvSubsystems32.dll appears in Type 1), that Excel.exe side-loads. The DLL is padded to roughly 75 MB with unrelated overlay data. The loader differs by variant. In the PureRAT variant the DLL shows a decoy PDF (proforma_invoice.pdf), copies itself to %LOCALAPPDATA%\u53g9ujpaxy1\, creates a Startup shortcut, and reassembles shellcode from 175 RCDATA resources (marker CHRD, configuration in resource ID 4000). That shellcode is a modified Donut loader whose encrypted data sits at a non-standard offset, which defeated existing Donut decryptors. It unpacks a .NET loader that decrypts PayloadSource.zip (TripleDES-CBC, then GZip) and loads PureRAT with Assembly.Load (protobuf-net.dll is among the resources). PureRAT beacons to tirakian.com on TCP 56001-56003 with campaign ID "bem" and an embedded certificate with Subject and Issuer CN=PureRAT Agent. On first contact it sends the security product name, webcam presence, user and domain name, OS version, idle time, active window title, executable path and a screenshot, and it steals data from browsers, crypto wallets (Atomic, Bitcoin-Qt, Electrum, Exodus and others) and messaging/mail clients (Telegram Desktop, Foxmail).

PureLogs is delivered by several loader types. Type 1 decrypts an RC4-encrypted decoy document, extracts an encrypted RAR to C:\Users\Public\WindowsUpdate and runs a bundled Python runtime that XOR-decrypts instruction.pdf and launches a .NET PureLogs downloader. Type 2-1 loads funtsub.dat (rolling XOR, Donut shellcode) and persists with a scheduled task WindowsFontCacheRestore running wscript.exe on FontCacheSync.vbs, a Startup LNK/BAT, and an HKCU Run key using regsvr32.exe /s. Type 2-2 runs rundll32.exe on the DLL export APIExportForDetours, disables AMSI and ETW, performs anti-debugging and anti-sandbox checks, reads propsys_1f520a24.cache up to the LABRUN marker, XORs with 0x85, extracts a ZIP with tar.exe, and runs a Python script every minute via a scheduled task that XOR-decodes trump.bin (0xAA) in memory as a Donut loader for PureLogs. Type 3 uses a side-loaded uxtheme.dll that XOR-decodes shellcode and injects it by process hollowing, then performs BYOVD: it drops the Lenovo-signed BootRepair.sys as C:\Users\Public\moimoi.sys, creates and starts a kernel service named moimoi (cmd.exe /c sc create moimoi binPath= C:\Users\Public\moimoi.sys type= kernel & sc start moimoi), and sends IOCTL 0x222014 with a target PID so the driver calls ZwTerminateProcess to kill security-product processes. It then downloads more Donut shellcode from C2 carrying PureLogs. The source does not name the hollowing target process or list the security products terminated.

PureLogs communicates over HTTP endpoints GET /ping and POST /plugin, /userinfo, /browser, /discord, /filesearch/req and /finish, with payloads encrypted as a 16-byte IV followed by AES-256-CBC over GZip data. It collects system information and screenshots, browser cookies and profiles, Discord data and file-search results, and fetches plugins. Because the payloads stay the same while loaders change, hash- and pattern-based defenses may miss new variants, and ITOCHU expects further loader changes. The source notes the Vietnamese comments and the Japan/Korea targeting but draws no attribution. Separate Cyderes (Howler Cell) reporting links PureRAT and PureLogs to the PureCoder malware-as-a-service suite, but that is about the malware family, not this campaign's operator.

## MITRE ATT&CK

- T1583.001 Domains
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1204.001 Malicious Link
- T1059.006 Python
- T1059.005 Visual Basic
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1543.003 Windows Service
- T1574.001 DLL
- T1036.007 Double File Extension
- T1027.001 Binary Padding
- T1055.012 Process Hollowing
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1218.011 Rundll32
- T1218.010 Regsvr32
- T1497.001 System Checks
- T1622 Debugger Evasion
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1113 Screen Capture

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PureRAT/PureLogs Signed Excel.exe DLL Side-Loading (AppVIsvSubsystems) and Double-Extension Launch** (`TL-2026-5841-SPL-001`)

TL-2026-5841 PureRAT and PureLogs loaders ship a Microsoft-signed Excel.exe renamed with a double extension (for example .pdf.exe) that side-loads a padded AppVIsvSubsystems64.dll or AppVIsvSubsystems32.dll from the unzip directory. This search fires on the DLL being loaded from outside an Office Program Files install, or on a double-extension or renamed Excel.exe process launch. It is behaviour-first, so it still fires when loader hashes change between samples.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.002, T1036.007, T1204.002, T1027.001
- **Data sources:** sysmon (EventCode 1 and 7, index=windows), microsoft_defender_for_endpoint (DeviceImageLoadEvents, DeviceProcessEvents)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=7 (ImageLoaded="*AppVIsvSubsystems64.dll" OR ImageLoaded="*AppVIsvSubsystems32.dll") NOT ImageLoaded="*Program Files*") OR (EventCode=1 (Image="*.pdf.exe" OR Image="*.mp4.exe" OR (OriginalFileName="Excel.exe" NOT Image="*Program Files*")))) | eval detection_signal=if(EventCode=7,"AppVIsvSubsystems DLL side-load outside Office path","Double-extension or renamed Excel.exe launch") | fillnull value="unknown" User Image | stats count min(_time) as first_seen max(_time) as last_seen values(ImageLoaded) as loaded_dll values(CommandLine) as cmdline values(ParentImage) as parent_image by host, User, Image, detection_signal | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
union
(DeviceImageLoadEvents
 | where Timestamp > ago(24h)
 | where FileName in~ ("AppVIsvSubsystems64.dll", "AppVIsvSubsystems32.dll")
 | where FolderPath !contains "Program Files"
 | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, ProcessName=InitiatingProcessFileName, ProcessPath=InitiatingProcessFolderPath, LoadedDll=FolderPath, SHA256, Signal="AppVIsvSubsystems DLL side-load outside Office path"),
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where FileName endswith ".pdf.exe" or FileName endswith ".mp4.exe" or (ProcessVersionInfoOriginalFileName =~ "Excel.exe" and FolderPath !contains "Program Files")
 | project Timestamp, DeviceName, AccountName, ProcessName=FileName, ProcessPath=FolderPath, LoadedDll="", SHA256, Signal="Double-extension or renamed Excel.exe launch")
| order by Timestamp desc
```

### Sigma

```yaml
title: PureRAT/PureLogs AppVIsvSubsystems DLL Side-Loaded Outside Office Install Path
id: 3f6c8a1e-5b0d-4e5a-9c1f-7a2d4b8e6c10
status: experimental
description: Detects loading of AppVIsvSubsystems64.dll or AppVIsvSubsystems32.dll from a location other than a Program Files Office install. The PureRAT and PureLogs campaign (TL-2026-5841) side-loads an oversized malicious copy through a Microsoft-signed Excel.exe renamed with a double extension such as .pdf.exe.
references:
  - https://blog-en.itochuci.co.jp/entry/2026/09/25/090000
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.defense-evasion
  - attack.execution
  - attack.t1574.002
  - attack.t1036.007
  - attack.t1204.002
  - attack.t1027.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - '\AppVIsvSubsystems64.dll'
      - '\AppVIsvSubsystems32.dll'
  filter_office_install:
    ImageLoaded|contains: '\Program Files'
  condition: selection and not filter_office_install
falsepositives:
  - Microsoft Office App-V clients installed in a non-standard directory
level: high
```

**Known false positives:**

- Office App-V components deployed outside Program Files by a software packaging team
- Software testers or packagers renaming Excel.exe for lab work

**Tuning notes:** Adjust the index name to your Sysmon index. Allow-list approved Office install roots (for example a C2R custom path) in the NOT clauses. Sysmon EventCode 7 must be enabled for image loads and scoped to avoid volume. Add a file-size check (DLL near 75 MB) where telemetry allows to raise fidelity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PureRAT/PureLogs Phishing Delivery - Lure Domains, Sender IPs and Pixeldrain ZIP Download (locked: unlock with TL Creds)
- PureRAT/PureLogs Persistence - WindowsFontCacheRestore Task, FontCacheSync.vbs, u53g9ujpaxy1 Startup and regsvr32 Run Key (locked: unlock with TL Creds)
- PureLogs C2 - Known Infrastructure and /filesearch/req Endpoint (locked: unlock with TL Creds)
- PureLogs Type 2-2 Loader - rundll32 APIExportForDetours, [indicator] and Public WindowsUpdate Python Runtime (locked: unlock with TL Creds)
- PureLogs Type 3 - uxtheme.dll Side-Loaded from Non-System Path (Process Hollowing Loader) (locked: unlock with TL Creds)
- PureRAT and PureLogs C2 DNS Resolution of Known Campaign Domains (locked: unlock with TL Creds)
- PureLogs Type 3 BYOVD - BootRepair.sys Loaded as moimoi Kernel Service (locked: unlock with TL Creds)
- PureRAT C2 Beaconing - [indicator] and TCP 56001-56003 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 47)

Defanged, TLP:CLEAR.

- IP address: `103.153.74[.]201`
- Domain: `tirakian[.]com`
- File hash: `2e05d97ed7bfabea8f7370ba627e0705ec2c0fbf3974b39437e9d95d45d1a76d`

Full set of 47 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [PureRAT and PureLogs Campaign Targeting Japanese Organizations (ITOCHU Cyber & Intelligence)](https://blog-en.itochuci.co.jp/entry/2026/09/25/090000)
- [PureRAT and PureLogs Campaign Targeting Japanese Organizations (SOC Prime active threats)](https://socprime.com/active-threats/purerat-and-purelogs-campaign-targeting-japanese-organizations/)
- [Job offer attack chains analysis (Cyderes Howler Cell, PureRAT/PureLogs background)](https://www.cyderes.com/howler-cell/job-offer-attack-chains-analysis)
- [Volexity donut-decryptor (tool that failed against the modified Donut loader)](https://github.com/volexity/donut-decryptor)
- [MITRE ATT&CK T1068 Exploitation for Privilege Escalation (cited by ITOCHU for BYOVD)](https://attack.mitre.org/techniques/T1068/)
- [MITRE ATT&CK T1574.002 DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)
- [MITRE ATT&CK T1055.012 Process Hollowing](https://attack.mitre.org/techniques/T1055/012/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5841