ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of known PureRAT indicators of compromise, which are frequently used by adversaries to establish persistent remote access and execute malicious payloads on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate infected assets before the ransomware-as-a-service tool can be leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: PureRAT Total IOCs: 37 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`82[.]22[.]7[.]20:5069`	botnet_cc	2026-09-06	75%
ip:port	`108[.]187[.]43[.]137:56003`	botnet_cc	2026-09-06	75%
ip:port	`108[.]187[.]43[.]144:56003`	botnet_cc	2026-09-06	75%
ip:port	`89[.]23[.]107[.]16:56001`	botnet_cc	2026-09-06	75%
ip:port	`89[.]23[.]107[.]16:56003`	botnet_cc	2026-09-06	75%
ip:port	`89[.]23[.]107[.]16:56002`	botnet_cc	2026-09-06	75%
ip:port	`145[.]249[.]115[.]103:56002`	botnet_cc	2026-09-06	75%
ip:port	`145[.]249[.]115[.]103:56003`	botnet_cc	2026-09-06	75%
ip:port	`145[.]249[.]115[.]103:56001`	botnet_cc	2026-09-06	75%
ip:port	`145[.]249[.]115[.]252:56001`	botnet_cc	2026-09-06	75%
ip:port	`145[.]249[.]115[.]252:56002`	botnet_cc	2026-09-06	75%
ip:port	`145[.]249[.]115[.]252:56003`	botnet_cc	2026-09-06	75%
ip:port	`153[.]80[.]240[.]86:56002`	botnet_cc	2026-09-06	75%
ip:port	`154[.]36[.]188[.]246:56002`	botnet_cc	2026-09-06	75%
ip:port	`154[.]36[.]188[.]246:56001`	botnet_cc	2026-09-06	75%
ip:port	`192[.]163[.]162[.]72:56002`	botnet_cc	2026-09-06	75%
ip:port	`192[.]163[.]162[.]72:56001`	botnet_cc	2026-09-06	75%
ip:port	`192[.]163[.]162[.]72:56003`	botnet_cc	2026-09-06	75%
ip:port	`177[.]5[.]78[.]71:56001`	botnet_cc	2026-09-06	75%
ip:port	`177[.]5[.]78[.]71:56002`	botnet_cc	2026-09-06	75%
ip:port	`156[.]240[.]108[.]46:56003`	botnet_cc	2026-09-06	75%
ip:port	`177[.]5[.]78[.]71:56003`	botnet_cc	2026-09-06	75%
ip:port	`156[.]240[.]108[.]46:56001`	botnet_cc	2026-09-06	75%
ip:port	`156[.]240[.]108[.]46:56002`	botnet_cc	2026-09-06	75%
ip:port	`179[.]236[.]107[.]22:56001`	botnet_cc	2026-09-06	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["144.172.65.241", "179.236.107.40", "179.236.107.22", "154.36.188.246", "82.22.7.20", "144.172.65.6", "177.5.78.71", "108.187.43.137", "153.80.240.86", "104.194.135.149", "145.249.115.252", "104.194.135.211", "192.163.162.72", "153.75.94.222", "104.194.135.115", "89.23.107.16", "144.172.65.156", "108.187.43.144", "145.249.115.103", "156.240.108.46"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["144.172.65.241", "179.236.107.40", "179.236.107.22", "154.36.188.246", "82.22.7.20", "144.172.65.6", "177.5.78.71", "108.187.43.137", "153.80.240.86", "104.194.135.149", "145.249.115.252", "104.194.135.211", "192.163.162.72", "153.75.94.222", "104.194.135.115", "89.23.107.16", "144.172.65.156", "108.187.43.144", "145.249.115.103", "156.240.108.46"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Scenario: A DevOps team deploys a custom internal build agent or CI/CD runner that reuses the same binary name or hash as a known PureRAT dropper to streamline containerized build processes.
- Filter/Exclusion: Exclude processes originating from specific CI/CD service accounts (e.g., svc-ci-builder) or paths within the build infrastructure directory (e.g., C:\BuildAgents\).
Scenario: An IT administrator runs a legacy vendor-provided utility for disk imaging or backup restoration that shares a similar file name or parent-child process relationship with the PureRAT IOCs.
- Filter/Exclusion: Whitelist specific vendor executables (e.g., VeeamBackup.exe, AcronisBackup.exe) or processes launched by known service accounts (e.g., svc-backup-service).
Scenario: A scheduled PowerShell job for log rotation or cleanup uses a temporary script name or path that matches one of the PureRAT IOCs (e.g., temp.ps1 in a specific user profile).
- Filter/Exclusion: Exclude PowerShell processes where the CommandLine contains specific scheduled task identifiers (e.g., -ExecutionPolicy Bypass -File C:\Scripts\LogCleanup.ps1) or processes owned by the SYSTEM account in standard system paths.
Scenario: A developer testing a new application locally uses a debug build that shares a binary name with a PureRAT component, running it from a non-standard directory like C:\Users\<dev>\Desktop\test\.
- Filter/Exclusion: Exclude processes running from user profile directories (C:\Users\*) where the parent process is a development IDE (e.g., code.exe, devenv.exe, idea64.exe) or a terminal emulator (e.g., cmd.exe,