#ParsedReport #CompletenessHigh
10-09-2026

Your Application Has Been Received: Inside Two Multi-Stage Attack Chains Hiding Behind Job Offers

https://www.cyderes.com/howler-cell/job-offer-attack-chains-analysis

Report completeness: High

Actors/Campaigns:
Purecoder

Threats:
Pxa_stealer
Purerat
Donut
Dll_sideloading_technique
Com_hijacking_technique
Motw_bypass_technique
Purecrypter
Purelogs
Pureminer
Pure_clipper
Blueloader
Resolverrat
Purehvnc_tool
Credential_harvesting_technique
Spear-phishing_technique

Victims:
Job seekers, Cryptocurrency assets

Geo:
Sweden, Netherlands, Bangladesh, India, Vietnam, United states

TTPs:
Tactics: 9
Technics: 20

IOCs:
IP: 1
File: 15
Domain: 1
Hash: 13
Url: 3
Registry: 2

Soft:
Task Scheduler, Microsoft Word, NET Reactor, Chromium, Chrome, Bitcoin-Qt, Microsoft Edge, Microsoft Edge PDF, Windows Task Scheduler

Wallets:
tronlink, metamask, coinbase, ronin_wallet, keplr, atomicwallet

Crypto:
binance

Algorithms:
sha256, gzip, xor, bzip, base64, zip

Functions:
StartAddress, sandbox_detected, agent_id_init, identity_get_pubkey_hex, process_checkin_response, persist_install, persist_remove, persist_mutex_acquire, get_sysinfo_json, get_networkinfo_json, have more...

Win API:
AmsiScanBuffer, EtwEventWrite, DisableThreadLibraryCalls, SetErrorMode, GetModuleFileNameW, CreateProcessW, TerminateProcess, NtSetContextThread, IsDebuggerPresent, GetTickCount64, have more...

Win Services:
bits

Languages:
python, jscript, vbscript