Loading malware…
BlueLoader is a malware family associated with the PureCoder criminal malware ecosystem. It has been advertised alongside other PureCoder offerings such as PureLogs, PureRAT, PureMiner, and PureCrypter, and is described by its operators as a botnet-oriented tool rather than an infostealer or remote-access trojan. Available reporting indicates that BlueLoader is intended to manage large numbers of infected hosts, automatically restart to maintain access, remove competing bots from compromised systems, and launch distributed denial-of-service attacks. BlueLoader has also appeared in the list of payload families supported by third-party crypter and delivery services used in commodity malware operations.
High-confidence public information on BlueLoader’s internal implementation, command-and-control protocol, infection workflow, and victimology remains limited. However, the family is consistently linked to the broader PureCoder malware-as-a-service ecosystem and is positioned as a Windows-focused botnet/loader capability used by cybercriminal operators. Its advertised persistence and bot-management features indicate post-compromise control of infected endpoints, while its bot-killing and DDoS functions suggest use in competitive criminal operations and disruptive activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
According to the developers, the BlueLoader botnet can manage a sizable quantity of bots, start up again automatically, launch DDoS attacks, and also possess a bot-eliminating capability.
1 distinct technique documented for this family, organized by ATT&CK tactic.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named PureCoder malware family mentioned as part of the broader PureCoder malware set.
A named PureCoder malware family mentioned as part of the broader PureCoder malware set.
A loader malware payload added in some campaigns by the same threat actor.
Named as another malicious tool sold by the same developer behind PURELOGS.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.