How to remove PureHVNC remote access trojan

What kind of malware is PureHVNC?

PureHVNC is a Remote Access Trojan (RAT). This type of malware enables remote access/control over infected devices. PureHVNC has extensive data-stealing abilities. This trojan has been proliferated via fake generative AI websites promoted through Facebook. There is strong evidence suggesting that the cyber criminals behind these campaigns are Vietnamese speakers.

PureHVNC malware overview

PureHVNC has been spread through AI-themed Facebook malvertising campaigns (more information can be found further in the article). However, this trojan could also be distributed using different methods. PureHVNC is a RAT (Remote Access Trojan) – a malicious program designed to allow remote access and control over machines.

The malware infiltrates systems in a two-stage chain. The first-stage executable launches a loader; several different ones have been encountered – most based on .NET. Multiple instances have been noted of the executable implementing a .NET Ahead-Of-Time (AOT) compilation for anti-analysis and anti-detection purposes.

The first stage is geared towards detection evasion and analysis prevention (e.g., searching information related to virtual machines, sandbox environments, security software, etc.), persistence ensurance, and further payload injection. PureHVNC is the core payload introduced in the second stage.

As mentioned in the introduction, this RAT has many data-stealing functionalities. It can extract and exfiltrate information from Chromium-based browsers and browser extensions (full list below). Targeted data can include browsing and search engine histories, Internet cookies, log-in credentials, personally identifiable details, credit/debit card numbers, etc.

The trojan can also collect data associated with cryptocurrency wallets, email clients, and messengers (listed below). PureHVNC uses plug-ins for additional functionality. One of the known plug-ins utilized by this trojan tracks foreground windows and takes screenshots of them when a keyword of interest is detected. The targeted words primarily center on banks, banking, and cryptowallets (list of known keywords).

To summarize, the presence of malicious software like the PureHVNC RAT on devices can lead to multiple system infections, severe privacy issues, financial losses, and identity theft.

Remote access trojan examples

We have investigated numerous RATs; CurlBack, ResolverRAT, Neptune, Lilith, and Triton are just some of our newest articles. These trojans can be incredibly versatile and multifunctional. However, even malware with limited capabilities poses significant dangers. What is more, malicious programs are often utilized in combination with others.

Yet regardless of how malware operates – its presence on a system threatens device integrity and user safety. Therefore, all threats must be eliminated immediately upon detection.

How did PureHVNC infiltrate my computer?

PureHVNC has been proliferated through Facebook malvertising campaigns using generative AI themed lures. Over seventy posts and multiple paid ads on said platform have been discovered. This content promoted fake websites imitating Kling AI – a generative AI service developed by Kuaishou Technology.

Users could upload images to the fraudulent sites to produce an AI-generated image or video, but instead of downloading the output – they downloaded a ZIP file. This archive contained an executable (.exe) that had its file type disguised with an extensive filename full of Hangul Filler characters and either an MP4 or JPG fake extension.

Other distribution methods are not unlikely. Phishing and social engineering techniques are standard in malware proliferation. Malicious software is typically disguised as or bundled with regular program/media files. Infectious files can be archives (ZIP, RAR, etc.), executables (.exe, .run, etc.), documents (PDF, Microsoft Office, Microsoft OneNote, etc.), JavaScript, and so on.

Malware is primarily spread via trojans (loaders/backdoors), drive-by (stealthy/deceptive) downloads, malicious attachments or links in spam emails/messages, online scams, malvertising, dubious download channels (e.g., freeware and third-party websites, P2P sharing networks, etc.), fake updates, and illegal software activation tools ("cracks").

Furthermore, some malicious programs can self-proliferate through local networks and removable storage devices (e.g., external hard drives, USB flash drives, etc.).

How to avoid installation of malware?

We recommend exercising caution while browsing since the Internet is full of deceptive and malicious content. Incoming emails, PMs/DMs, SMSes, and other messages must be treated with care. Attachments or links found in suspicious/irrelevant mail must not be opened, as they can be infectious.

We advise downloading only from official and verified sources. Another recommendation is to activate and update software using genuine functions/tools, as those obtained from third-parties can contain malware.

It is essential to have a reputable antivirus installed and kept up-to-date. Security programs must be used to run regular system scans and to remove detected threats. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Facebook malvertising used to promote PureHVNC (image source – Check Point):

Fake Kling AI Facebook profile used to promote PureHVNC:

Fake generative AI websites that trick victims into downloading PureHVNC:

Sample 1:

Sample 2:

Browsers targeted by PureHVNC:

7Star, 360Browser, Amigo, Atom, Brave, CentBrowser, Chedot, Chrome, ChromePlus, Chromodo, Citrio, CocCoc, Comodo, Coowon, Dragon, Edge, Elements, Epic, Iridium, K-Melon, Kometa, liebao, Maxthon3, Nichrome, Orbitum, Privacy, QIP, QQBrowser, Sleipnir5, Sputnik, Surf, Torch, Uran, and Vivaldi.

Targeted cryptocurrency-related browser extensions:

Binance Chain Wallet, BitApp, BitClip, BitKeep, Braavos, Coin98, Coinbase, CONex, Cyano, EQUAL, Exodus, Finnie, Guarda, iWallet, Jaxx, Keeper, Keplr, Liberty, Liquality, Math, MetaMask, MOBOX, Nifty, Phantom, Rabet, Ronin, Solana, Swash, Terra Station, TezBox, TronLink, Trust, Waves Keeper, Wombat, XDCPay, XDEFI, Yoroi, and ZilPay.

Targeted authentication and password-management browser extensions:

Authenticator, Authy, EOS Authenticator, GAuth Authenticator, and Trezor Password Manager.

Targeted desktop cryptowallets:

• Atomic Wallet
• Bitcoin-Qt
• Dash-Qt
• Electrum
• Ethereum
• Exodus
• Jaxx
• Ledger Live
• Litecoin-Qt
• Zcash

Other software targeted:

• Foxmail
• Telegram

Keywords searched by PureHVNC:

ABANCA, atomic wallet, atomicwallet, Banca Agricola Popolare, Banca Monte dei Paschi di Siena, Banca Sella Group, Banco Aliado, Banco Ambrosiano, banco av villas, Banco Azteca, banco bac, Banco BBP, banco bbva, Banco BCT Bank International, Banco Bi-Bank, Banco Caja Social, Banco ctt, Banco da Itália, Banco Davivienda, Banco de Bogotá, Banco de Occidente, Banco di Napoli, Banco do Brasil, Banco do Nordeste, Banco Ficohsa, banco general, Banco General Panamá, banco GNB, Banco inter, Banco pan, Banco Santander, Bancolombia, banistmo, bank of america, Bankinter, bbva, BBVA Colômbia, binance, Brandesco, Bybit, Caixa geral de depósitos, caixabank, Caja de Ahorros, chase bank, Citibank Colômbia, Citigroup, coinbase, Colpatria, Credito agricola, dkb bank, dkb.de, Eurobic, exodus, facebook ads, FinecoBank, Gate.io, gemini.com, gemini.com/exchange, GNB Sudameris, Goldman Sachs, google ads, HSBC, Huntington, Intesa Sanpaolo, Itaú Corpbanca Colômbia, JP Morgan Chase, Lloyds Bank, metamask, Metro Bank, Moey, Montepio, Novobanco, Nubank, Openbank, paypal, Poloniex, Prosperity Bank, Revolut, Sanpaolo IMI, Santander, Santander UK, Starling Bank, Truist Bank, trustwallet, Unibanco, UniCredit, usbank, Virgin Money UK, wellsfargo, westernunion.

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is PureHVNC?
• STEP 1. Manual removal of PureHVNC malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with PureHVNC malware, should I format my storage device to get rid of it?

Malware removal rarely requires formatting.

What are the biggest issues that PureHVNC malware can cause?

The threats posed by an infection depend on the malware's abilities and the cyber criminals' modus operandi. PureHVNC allows remote control over devices and has extensive data-stealing functionalities. Generally, malware of this kind can cause multiple system infections, serious privacy issues, financial losses, and identity theft.

What is the purpose of PureHVNC malware?

Malware is mainly used to generate revenue. However, cyber criminals can also use malicious software to amuse themselves, realize personal grudges, disrupt processes (e.g., sites, services, companies, etc.), hacktivism, and launch politically/geopolitically motivated attacks.

How did PureHVNC malware infiltrate my computer?

PureHVNC has been spread through fake AI-generated content distributed by fake sites promoted via Facebook. Other distribution techniques are possible. Malware is predominantly proliferated through trojans, drive-by downloads, online scams, malvertising, spam mail, suspect download channels (e.g., freeware and third-party websites, P2P sharing networks, etc.), illegal software activation tools ("cracks"), and fake updates.

Will Combo Cleaner protect me from malware?

Combo Cleaner is capable of detecting and removing practically all known malware infections. Remember that running a complete system scan is essential since sophisticated malicious software usually hides deep within systems.