Loading malware…
PureCrypter is a Windows malware-as-a-service loader and crypter written in C# and sold in cybercrime forums by an operator known as PureCoder, who is also associated with other Pure-branded malware. Active since at least 2021, it is used as a commercial obfuscation, evasion, and injection platform to deliver a wide range of commodity malware families, including information stealers, remote access trojans, cryptominers, and ransomware. Reported downstream payloads include AgentTesla, RedLine, AsyncRAT, Formbook, SnakeKeylogger, Mars Stealer, Raccoon, PureMiner, PureLogs, PureRAT, BunnyLoader follow-on payloads, and Mallox ransomware.
PureCrypter commonly uses a staged architecture composed of a downloader and an injector. The downloader retrieves an encrypted or otherwise transformed second stage, often disguised as benign content such as image or multimedia files. The injector then decodes, decompresses, decrypts, and launches the final payload, frequently from embedded resources. Observed protection and packing methods include reverse-byte encoding, GZip compression, Protobuf-serialized configuration data, and symmetric encryption schemes including AES, DES, RC4, and 3DES. Samples are often heavily obfuscated, including use of .NET protectors such as SmartAssembly, and may rely on reflective loading or process hollowing to execute payloads inside legitimate Windows processes.
The malware emphasizes defense evasion and anti-analysis. Documented behaviors include hidden execution through .NET process window settings, sandbox and debugger checks, virtualization detection, monitor-size and username heuristics, AMSI and ETW patching, Windows Defender exclusion changes, and self-deletion when analysis conditions are detected. PureCrypter can also identify installed antivirus products and transmit infection telemetry through encrypted channels, including TLS 1.2-protected webhook notifications. Persistence options have included common Windows autorun mechanisms.
PureCrypter is regularly used as an intermediate delivery layer in broader intrusion chains rather than as the final monetization payload. It has appeared in phishing-driven campaigns, fake cracked-software distribution, spam-delivered archive infections, SQL Server exploitation leading to ransomware deployment, and multi-stage loader ecosystems. Threat actors and clusters publicly associated with its use include APT-C-36, TAG-144, Fluffy Wolf, operators in the Mallox ransomware ecosystem, and other commodity-malware distributors. It has also been assessed as the likely crypter used in the WhisperGate file-wiper loader chain.
The malware targets Windows systems and is especially prevalent in financially motivated campaigns affecting enterprises, government entities, and regional business targets, including organizations in South America, Ukraine-related destructive operations, and Russian organizations targeted through phishing. PureCrypter’s role as a reusable loader-for-hire and packer service makes it a significant enabling component in the commodity malware ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.
The payloads dropped through MS-SQL exploitation correspond to PureCrypter... This third-party payload is the Mallox ransomware.
While they still leverage classic droppers like PureCrypter and Rust-based loaders running Donut shellcode, they have added a potent new tool to their arsenal: PowerLoader.
PureCrypter malware has been observed distributing multiple RATs and information stealers. It is a .NET-based executable, obfuscated with SmartAssembly...
28 distinct techniques documented for this family, organized by ATT&CK tactic.
The module checked the output of WMI queries to identify a virtual or sandbox environment.
The dropper first created a new PowerShell process to pause the program... The encoded command decoded to cmd /c timeout 21. Another variant used the command... Start-Sleep -s 20.
The actual payload files stored in the resource are released to the tmp directory and triggered by the start.bat.
Powershell解码出一个base64编码的VBS loader: VBS loader进一步释放一个downloader,并通过shellcode运行后者。
with mutexes creation and persistence being done based on the configuration
создает в папке Startup VBS-скрипт Task.vbs для автозапуска... копирует StilKrip.exe в папку %AppData% под именем Action.exe и создает в папке Startup VBS-скрипт Action.vbs для автозапуска.
запускает системную утилиту InstallUtil.exe и внедряет в ее процесс расшифрованный модуль... затем передать ей управление.
with mutexes creation and persistence being done based on the configuration
создает в папке Startup VBS-скрипт Task.vbs для автозапуска... копирует StilKrip.exe в папку %AppData% под именем Action.exe и создает в папке Startup VBS-скрипт Action.vbs для автозапуска.
PureCrypter can establish persistence via: Run keys; Explorer User Shell Folder and Shell Folders; Winlogon.
The file byte order is reversed, likely to evade detection by host-based controls. The loader restores the byte order and then performs multiple rounds of extraction and decoding of nested resources to get to the final malicious code.
внутри которого находится исполняемый файл, маскирующийся под PDF-документ... Кроме того, злоумышленники используют двойное расширение .pdf.rar.
запускает системную утилиту InstallUtil.exe и внедряет в ее процесс расшифрованный модуль... затем передать ей управление.
If any of these failed, the sample started a clean-up operation by using PowerShell to delete itself from disk, closing its mutex, and exiting.
запускает системную утилиту InstallUtil.exe и внедряет в ее процесс расшифрованный модуль.
установка различных методов автозапуска и проверка окружения на отладку или виртуальную среду.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
установка различных методов автозапуска и проверка окружения на отладку или виртуальную среду.
152 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
PureCrypter is a Malware-as-a-Service loader/crypter used here to download, decrypt, and reflectively load the next-stage Mallox ransomware. It includes anti-analysis checks, ETW and AMSI patching, Defender exclusions, persistence, and privilege adjustment.
TAG-144’s Persistent Grip on South American Organizations AsyncRAT BitRAT DCRat LimeRAT NjRAT PureCrypter Quasar RAT Remcos
PureCrypter is mentioned as a payload distributed by a large botnet cluster within the Amadey ecosystem.
Used by Fluffy Wolf as a classic dropper in phishing campaigns to help deliver malicious payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.