MalwareUsed by 1 actor

PUROSANGUE

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Cruciferra

eSentire describes a Cruciferra package called PUROSANGUE that produces a NativeAOT side-loaded DLL with EDR/AV killing, COM Elevation Moniker UAC bypass, process hollowing into ServiceModelReg.exe, and 145 default AV/EDR process targets.

via lastpass blogblog.lastpass.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1543.003Windows ServiceEvidence1

The malware installs itself as a Windows service that starts automatically every time the computer boots. It then loops continuously: checking for security products, killing any that have restarted, and re-running the stealer.

Privilege Escalation

4 techniques

T1055.012Process HollowingEvidence1

eSentire describes a Cruciferra package called PUROSANGUE that produces... process hollowing into ServiceModelReg.exe.

T1068Exploitation for Privilege EscalationEvidence1

Alinubx.sys is a renamed, identity-swapped version of CcProtect.sys... a driver already listed on LOLDrivers with public proof-of-concept killer code.

T1543.003Windows ServiceEvidence1

T1548.002Bypass User Account ControlEvidence1

The malware attempts three different methods to obtain administrator-level access... eSentire describes a Cruciferra package called PUROSANGUE that produces... COM Elevation Moniker UAC bypass.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

This sample also stores payloads in .reloc and uses the same custom Base16 style, with bytes in the 0x50 to 0x5F range corresponding to PQRSTUVWXYZ[\]^_.

T1055.012Process HollowingEvidence1

eSentire describes a Cruciferra package called PUROSANGUE that produces... process hollowing into ServiceModelReg.exe.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence2

[The kernel driver] was designed to terminate 145 antivirus and endpoint security products... checking for security products, killing any that have restarted.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

security weekNews

Sep 21, 2026

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer - SecurityWeek

A Cruciferra crypter package likely used to produce the malicious DLL loaded by the fake installer; it has been associated with side-loaded DLL payloads containing code to disable endpoint detection and antivirus products.

bleeping computerNews

Sep 18, 2026

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

Crypter used to build the loader delivering Rapuncel in this campaign.

lastpass blogNews

Aug 13, 2026

Threat Intel | One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution Network for its Campaign

A Cruciferra crypter package or closely related derivative assessed as the source lineage for the malicious vsdbg.dll NativeAOT side-loaded loader. Its described functions include EDR/AV process killing, UAC bypass, persistence, DLL side-loading, and process hollowing.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

PUROSANGUE

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Cruciferra

via lastpass blogblog.lastpass.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1543.003Windows ServiceEvidence1

Privilege Escalation

4 techniques

T1055.012Process HollowingEvidence1

eSentire describes a Cruciferra package called PUROSANGUE that produces... process hollowing into ServiceModelReg.exe.

T1068Exploitation for Privilege EscalationEvidence1

Alinubx.sys is a renamed, identity-swapped version of CcProtect.sys... a driver already listed on LOLDrivers with public proof-of-concept killer code.

T1543.003Windows ServiceEvidence1

T1548.002Bypass User Account ControlEvidence1

The malware attempts three different methods to obtain administrator-level access... eSentire describes a Cruciferra package called PUROSANGUE that produces... COM Elevation Moniker UAC bypass.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

This sample also stores payloads in .reloc and uses the same custom Base16 style, with bytes in the 0x50 to 0x5F range corresponding to PQRSTUVWXYZ[\]^_.

T1055.012Process HollowingEvidence1

eSentire describes a Cruciferra package called PUROSANGUE that produces... process hollowing into ServiceModelReg.exe.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence2

[The kernel driver] was designed to terminate 145 antivirus and endpoint security products... checking for security products, killing any that have restarted.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

security weekNews

Sep 21, 2026

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer - SecurityWeek

bleeping computerNews

Sep 18, 2026

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

Crypter used to build the loader delivering Rapuncel in this campaign.

lastpass blogNews

Aug 13, 2026

Threat Intel | One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution Network for its Campaign

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.