PureRAT variant observed in AI Video Player
Executive Summary
I analyzed a malware chain beginning with DriveVideoSetup-x64-0.1.0.exe, distributed through a fake Drive Video /SMVEO-themed lure. The malware uses a staged execution chain that moves from Python bytecode into shellcode, then into multiple protected .NET assemblies.
The chain includes heavy obfuscation and encryption, runtime patching ,certificate generation, protobuf references, and authenticated WebSocket communications.
Dynamic analysis observed the malware enrolling with infrastructure, creating certificate material under%LOCALAPPDATA%\SMVEO\, connecting to agent.sm-veo.com, and loggingagent starting 2.3.0, auto-enrolling, and ws connection.
Multiple indicators suggest this activity is DonutLoader leading toPureRAT.
Execution Workflow
DriveVideoSetup-x64-0.1.0.exe ↓ Persistence via CurrentVersion\Run ↓ python.pyc ↓ Base85 decode ↓ zlib decompress ↓marshal.loads() ↓ shellcode3.bin ↓ VirtualAlloc / RtlMoveMemory / CreateThread ↓ .NET Loader Stage:Mdswhvizp / Ykzrh-style protected loader ↓ Encrypted resources and virtualized dispatch ↓ Embeddedresource: Xuvrfuo ↓ TripleDES-CBC decrypt ↓ Raw inflate after small header ↓ .NET Stage: Uwjoqtb ↓Encrypted resources / runtime patch metadata ↓ Certificate enrollment ↓ Authenticated WebSocketcommunications ↓ Remote tasking / script execution
Delivery and Sandbox Caveat
The lure uses a fake Google Drive-style video download flow and delivers: DriveVideoSetup-x64-0.1.0.exe
The certificate signer / publisher artifact observed across related samples is: Smartcore LLC
Persistence is established through: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
The Python stage may not execute immediately. In several sandbox-style environments, the installer may only stage persistence. The later Python → shellcode → .NET chain may require reboot, logon, or manual triggering of the persisted Run key.
App Any Run Snadbox Run
Note: Non-Public sandbox when run under Windows 11 has full execution chain
Python Stage
The persisted Python bytecode stage contains loader indicators:
The deobfuscation order observed for this stage is:
Python Stage 2:
This second stage of python has 2 blobs, one is Base64 (RSA key) and the second is another Base85 + zlib blob. The interesting thing about this stage is the "hybrid_decrypt" function with performs
xor + aes + rc4 functions.
Python Stage 3 (Shellcode Loader):
key16 0x19
encrypted blob @ >0x241
custom 16-round PRNG/stream cipher resulting PE starts at offset 0x104C after decryption
This can be extracted using Donut-Decrypt by Volexity
.NET Loader and Virtualization
Follow-up analysis of extracted .NET loader stage, internally named Ykzrh.exe (smveo-csharp-agent.exe) in one recovered artifact, revealed a substantial virtualization and runtime reconstruction layer. This helps explain why the .NET portions of the chain initially appeared incomplete or nonsensical in decompilers.
Xuvrfuo Decryption
The first major .NET resource extraction pivot was the embedded resource:
Resource: Xuvrfuo
Algorithm: TripleDES-CBC
Padding: PKCS7
TripleDES Key: 1E4760505B92C0AA0DE15226D001EE47
TripleDES IV: 1AB225BFC42E570D
.NET Stage: Uwjoqtb
The decompressed payload fromXuvrfuo produced the protected .NET assembly:
UwjoqtbVersion Framework.NET Framework 4.0 Timestamp2026-05-23 Microsoft DetectionThe assembly is heavily protected and contains multiple encrypted resources. Static decompilation shows many stubs, proxy methods, and incomplete code paths. Runtime debugging and resource decryption show that important functionality is activated dynamically.
Certificates and C2
The malware creates a working directory under:
| Artifact | Purpose |
|---|---|
| client.crt | Generated client certificate. |
| client.key | Generated client private key. |
| ca.crt | CA certificate material used by the agent. |
| Infrastructure | Context |
|---|---|
| smveo.com | Lure / infrastructure domain. |
| admin.sm-veo.com | Enrollment / administration endpoint. |
| agent.sm-veo.com | Agent communication endpoint. |
| wss://agent.sm-veo.com:8443/v1/ws | Observed WebSocket C2 endpoint. |
| 103.183.115.177:56001 | Observed in lab. |
| 103.183.115.177:56002 | Observed in lab. |
| 103.183.115.177:56003 | Observed in lab. |
The certificate workflow suggests mutual TLS-style authentication and custom certificate validation. This would make casual interception with Burp, Fiddler, or mitmproxy more difficult unless the certificate validation path is bypassed.
Detection and Hunting
Runtime strings: agent starting 2.3.0, auto-enrolling, registered successfully, ws connected, running script
YARA: GitHub YARA Rules
Samples
| Sample | SHA256 |
|---|---|
| DriveVideoSetup-x64-0.1.0.exe | f3284e498890139de2f94be50b260ec7547a91a63d72b926b71ae343106edc02 |
| drivevideo.pyc | e70cc6dddce8717ea5b4d3597d1543d43cfa9a0c2eac6c52f309adfe879b7352 |
| python.pyc | ca36b7438f248e01a20808fa0bbd30938eb3fac792b5ca59bf3ade01afa48992 |
| Ykzrh.exe (PureCrypter) | 6ef97cd831f3cd77ee2dcf98b100b31672887ede7c34ed2017039b9ae434ff9d |
| Xuvrfuo | 628adb8b1814491d74b1cbf9d1ef25e36e93f58f8bc2d24b536bcd1627232a34 |
| Uwjoqtb.dll (PureRAT) | 8e751724a30386948628c786e6cf4c894aebec8aa36d979b13d6b61a6b5e29c7 |
| Extracted Shellcode | 6805394cfec5a680860c5828ca003216fdc626e91ac649a177d2c64ee1ed8127 |
Key Findings
- Three-stage Python loader chain.
- Stage 3 decodes Base64 shellcode.
- Shellcode uses custom 16-round stream cipher.
- Recovered PE matches operational .NET agent.
- Agent generates certificates and enrolls with SMVEO infrastructure.
- Authenticated WebSocket communications observed.
- Strong overlap with publicly documented PureRAT activity.
Comments
Post a Comment