Do Son IIJ exposed a novel loader that simultaneously deploys TorNet (TOR C2) and PureHVNC (RAT) via DLL sideloading. It uses MurmurHash2 for API hashing and injects into jsc.exe for stealth.
TorNet
Among the malware deployed in this campaign is a previously undocumented backdoor called TorNet, which is being distributed via PureCrypter malware