Loading malware…
PureCrypter is a commercial C#/.NET malware loader for Windows, sold as malware-as-a-service since at least 2021 by the developer known as PureCoder, also called PureTeam. It provides configurable payload obfuscation, delivery, and injection for unrelated malware families. Observed payloads include Agent Tesla, RedLine, FormBook, AsyncRAT, PureLogs, PureMiner, BunnyLoader, and Mallox ransomware.
Its typical architecture combines a downloader with an injector that decrypts and executes the final payload. Downloaded components frequently masquerade as images or multimedia files. Payload protection includes byte reversal, compression, symmetric encryption, and .NET obfuscation. PureCrypter supports reflective loading and multiple process-injection methods, including process hollowing, allowing payloads to execute inside legitimate Windows processes.
Configurable capabilities include registry-based and Startup-folder persistence, installed-antivirus discovery, hidden process windows, execution delays, debugger and virtualization checks, and sandbox detection. Observed variants can modify Microsoft Defender exclusions, patch AMSI and ETW, request elevated execution, and adjust process privileges. Some builds display misleading error messages or delete themselves when anti-analysis checks fail.
PureCrypter has appeared in phishing and spam campaigns using malicious archives, cracked-software bundles, script-based delivery chains, and deployments following server compromise. Legitimate hosting services, including Discord, have been abused to distribute its components. Its users include 8220 Gang, APT-C-36, and Mallox ransomware operators. Documented deployments include attacks against Russian organizations and compromised Microsoft SQL Server systems. Its broad availability and support for arbitrary payloads make it a shared delivery component rather than a tool exclusive to one actor or industry.
6 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
We have observed 8220 Gang using the PureCrypter Malware-as-a-service. PureCrypter is a loader service available for a low cost since 2021 and has been observed distributing a large variety of commodity malware.
The late-2023 PureRAT v0.3.8B build used an in-memory PE loader component protected with SmartAssembly-protected PureCrypter.
APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.
While they still leverage classic droppers like PureCrypter and Rust-based loaders running Donut shellcode, they have added a potent new tool to their arsenal: PowerLoader.
PureCrypter malware has been observed distributing multiple RATs and information stealers. It is a .NET-based executable, obfuscated with SmartAssembly...
60 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development Web Services: Cloudflare Tunnels T1583.006 1–6 Free Quick Tunnel, no account required
Adversaries may buy, steal, or download malware that can be used during targeting.
Основной механизм распространения Pure в рамках этой кампании — спам с вредоносным вложением в виде RAR-архива или ссылкой на архив.
Using highly deceptive tactics, the attackers send emails masquerading as legitimate corporate communications regarding outstanding debts, reconciliation statements, or legal claims. To bypass modern email security gateways, the attackers heavily rely on malicious RAR attachments...
...а в других случаях жертве предоставляли ссылку на GitHub-репозиторий, откуда загружался RAR-архив. По словам исследователей, Fluffy Wolf активно использует GitHub, потому что такие ссылки выглядят легитимно и помогают обходить почтовые фильтры...
The module checked the output of WMI queries to identify a virtual or sandbox environment.
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The dropper first created a new PowerShell process to pause the program... The encoded command decoded to cmd /c timeout 21. Another variant used the command... Start-Sleep -s 20.
The actual payload files stored in the resource are released to the tmp directory and triggered by the start.bat.
Powershell解码出一个base64编码的VBS loader: VBS loader进一步释放一个downloader,并通过shellcode运行后者。
The ZIP contains a Python runtime and one or more loader scripts. Each loader decrypts embedded shellcode, and that shellcode bootstraps the .NET Common Language Runtime (CLR) to load the actual payload.
allocate RWX memory, write shellcode via WriteProcessMemory ... ctypes.windll.kernel32.VirtualProtect(... 0x40, # PAGE_EXECUTE_READWRITE ... )
This is mainly seen in some cracking software, downloader module is bundled to the former for propagation with Bat2Exe.
Typically, AgentTesla campaigns involve phishing emails carrying malicious attachments... After all infection stages are executed on the victim's system, the final payload initiates actions to sustain persistence...
After patching, Donut loads mscoree.dll , calls CLRCreateInstance to start the .NET CLR (v4.0.30319), and invokes ExecuteInDefaultAppDomain with the target class and method names stored in the instance.
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
with mutexes creation and persistence being done based on the configuration
создает в папке Startup VBS-скрипт Task.vbs для автозапуска... копирует StilKrip.exe в папку %AppData% под именем Action.exe и создает в папке Startup VBS-скрипт Action.vbs для автозапуска.
PureCrypter can establish persistence via: Run keys; Explorer User Shell Folder and Shell Folders; Winlogon.
the .lnk file is used to start the powershell to execute the malicious command
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
запускает системную утилиту InstallUtil.exe и внедряет в ее процесс расшифрованный модуль... затем передать ей управление.
Injection technique: create a suspended notepad.exe , allocate RWX memory, write shellcode via WriteProcessMemory , queue an APC, resume the thread... Instead of notepad.exe, the loaders now create a suspended explorer.exe and use Early Bird APC injection
根据配置的不同存在4种注入方式,傀儡进程(Process Hollowing)是被最多使用的方式。
Finally, the malware looks at its processus privileges in order to elevate them with the SeDebugPrivilege... The ransomware then adjusts its privileges to leverage the SeTakeOwnershipPrivilege and SeDebugPrivilege privileges.
with mutexes creation and persistence being done based on the configuration
создает в папке Startup VBS-скрипт Task.vbs для автозапуска... копирует StilKrip.exe в папку %AppData% под именем Action.exe и создает в папке Startup VBS-скрипт Action.vbs для автозапуска.
PureCrypter can establish persistence via: Run keys; Explorer User Shell Folder and Shell Folders; Winlogon.
the .lnk file is used to start the powershell to execute the malicious command
This command included the verb runas to execute with admin privileges... The user thinks he is installing a cracked application and so the UAC prompt does not raise any suspicion.
The file byte order is reversed, likely to evade detection by host-based controls. The loader restores the byte order and then performs multiple rounds of extraction and decoding of nested resources to get to the final malicious code.
Here is an example of an injector obfuscated by SmartAssembly
Obfuscated Files: Encrypted Payload T1027.013 Multi-layer XOR + Chaskey CTR + AES
внутри которого находится исполняемый файл, маскирующийся под PDF-документ... Кроме того, злоумышленники используют двойное расширение .pdf.rar.
Masquerading: Match Legitimate Name T1036.005 DATEV invoice filename
запускает системную утилиту InstallUtil.exe и внедряет в ее процесс расшифрованный модуль... затем передать ей управление.
Injection technique: create a suspended notepad.exe , allocate RWX memory, write shellcode via WriteProcessMemory , queue an APC, resume the thread... Instead of notepad.exe, the loaders now create a suspended explorer.exe and use Early Bird APC injection
根据配置的不同存在4种注入方式,傀儡进程(Process Hollowing)是被最多使用的方式。
The malware uses a technique detailed by The Red Team Vade Mecum called EtwEventWrite Patching to avoid system logging events.
If any of these failed, the sample started a clean-up operation by using PowerShell to delete itself from disk, closing its mutex, and exiting.
Finally, the malware looks at its processus privileges in order to elevate them with the SeDebugPrivilege... The ransomware then adjusts its privileges to leverage the SeTakeOwnershipPrivilege and SeDebugPrivilege privileges.
запускает системную утилиту InstallUtil.exe и внедряет в ее процесс расшифрованный модуль.
wscript.exe //B \\tunnel1\DavWWWRoot\dat.wsh
установка различных методов автозапуска и проверка окружения на отладку или виртуальную среду.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
After patching, Donut loads mscoree.dll , calls CLRCreateInstance to start the .NET CLR (v4.0.30319), and invokes ExecuteInDefaultAppDomain with the target class and method names stored in the instance.
Скачав файл, StilKrip.exe расшифровывает его и выполняет. При этом все действия он совершает в памяти собственного процесса, и на диске ничего не создается.
The first check is for the presence of a debugger by using CheckRemoteDebuggerPresent and by enumerating loaded modules to identify SbieDll.dll.
The Exclusion module is used to add an exclusion to defender for the root drive from which the process is executed.
установка различных методов автозапуска и проверка окружения на отладку или виртуальную среду.
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.
The first check is for the presence of a debugger by using CheckRemoteDebuggerPresent and by enumerating loaded modules to identify SbieDll.dll.
The following details about the current environment are collected and sent via a POST request... Most of the data collection modules are functionally similar...
We identified several zip files that contained droppers for Redline InfoStealers.
C2 Application Layer Protocol: Web Protocols T1071.001 1–6 WebDAV over HTTPS for staging
Proxy: External Proxy T1090.002 Cloudflare tunnel for staging
В ответ от С2 приходит несколько сообщений, содержащих дополнительные модули (плагины) и конфигурацию к ним... способен выкачивать по переданному URL файл и запускать его.
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
All tunnels use Cloudflare's free Quick Tunnel service ( trycloudflare.com ). The origin server IP is never exposed — all traffic proxies through Cloudflare's anycast network
156 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.