PureCrypter — C# Malware-as-a-Service Loader Distributing 10+ Malware Families
PureCrypter — C# Malware-as-a-Service Loader Distributing (TL-2026-0753), also tracked as PureCrypter, is a high-severity malware campaign, first published 2026-06-10. It has no confirmed attribution, affects Microsoft Windows, maps to 21 MITRE ATT&CK techniques (T1027, T1033, T1036), and is covered by 9 detection rules and 46 indicators of compromise.
Key facts for TL-2026-0753
- Threat ID
- TL-2026-0753
- Also known as
- PureCrypter, Pure Crypter
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-10
- Last reviewed
- 2026-06-10
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- government, technology, financial, manufacturing
- Target regions
- North America, Asia-Pacific, Europe, South America
- Detection rules
- 9
- Indicators of compromise
- 46
Malware and tooling in PureCrypter — C# Malware-as-a-Service Loader Distributing
Malware and tooling: Discord webhook beacon (username PureCrypter, TLS 1.2), Donut - S0695, SmartAssembly, Telegram Bot API (api.telegram.org/bot[TOKEN]/sendMessage)
PureCrypter is a C#/.NET Malware-as-a-Service loader (sold from ~$59-60) first observed in March 2021 that uses a two-module downloader-plus-injector chain to deliver 10+ malware families including AgentTesla, RedLine, AsyncRAT, SnakeKeylogger, Remcos, and DarkVision RAT. The injector employs process hollowing and two other injection methods, SmartAssembly obfuscation, AES/DES/RC4 encryption, gzip compression, Protobuf-based configuration, sandbox/VM evasion, and multiple persistence routines, distributed across 200+ C2 domains and IPs.
How PureCrypter — C# Malware-as-a-Service Loader Distributing works
PureCrypter is a commercially sold (Malware-as-a-Service) loader written in C#/.NET, advertised on clearnet for roughly $59-60 and in active use since at least March 2021. It is consumed by many distinct criminal customers to stage and deliver second-stage payloads, and has been observed propagating more than ten malware families: Formbook, AgentTesla, SnakeKeylogger, RedLine Stealer, AsyncRAT, Mars Stealer, Raccoon, Azorult, Remcos, LokiBot, NanoCore, DcRAT, Arkei, WarzoneRAT, PureMiner, PureClipper, and (in 2024) DarkVision RAT.
The loader is delivered via two cooperating modules using a "package" mechanism. The lightly obfuscated Downloader module calls WebClient.DownloadData against hardcoded URIs — frequently abusing reputable file-hosting such as Discord CDN (cdn.discordapp.com) and transfer.sh — to retrieve the heavily obfuscated Injector module. Payloads are protected for transport with a layered scheme: PE header byte-reversal/inversion, gzip/zlib compression (magic 1F 8B 08 00), and symmetric encryption (AES-CBC, DES, or RC4). A fixed AES key (2F820378FEEFBD90987D05D28F0FF0FE) and IV (742CA81F5AC2028E04861092F9F72ECB) have been recovered from samples. The injector's configuration is stored as a Google Protobuf structure, extracted via a "Reverse + GZip + Protobuf.Deserialize" chain, making payloads malleable and resistant to static AV signatures. The binary itself is obfuscated with the commercial SmartAssembly product plus junk-code insertion and encrypted resources.
Before detonation the injector runs execution guardrails: a global mutex (mutual exclusion), configurable delayed execution, WMI environment checks (Win32_BIOS SerialNumber/Version matched against VMware|VIRTUAL|A M I|Xen and Win32_ComputerSystem Manufacturer/Model against Microsoft|VMWare|Virtual), CheckRemoteDebuggerPresent debugger detection, a Sandboxie SbieDLL.dll module check, display-resolution checks, and geolocation-based exclusion regions. It can add Microsoft Defender exclusions via Set-MpPreference -ExclusionPath, perform memory-bombing (allocating 400-500MB regions to thwart sandboxes), and duplicate file handles into explorer.exe for anti-deletion. The injector supports three execution methods selected by config: process hollowing (RunPE — CreateProcessA suspended, ZwUnmapViewOfSection, write payload, set thread context, resume; commonly targeting MSBuild.exe), raw shellcode execution, and in-memory .NET assembly loading/Invoke. Persistence is achieved through HKCU Run keys, a Winlogon Shell modification, Startup-folder drops, and Scheduled Tasks, with masqueraded filenames (svchosts.exe, firefox.exe, chrome.exe, Taskmgr.exe) in decoy directories. Infection status is beaconed to operators over TLS 1.2 via Discord webhooks (WebClient.UploadValues) or the Telegram Bot API. With Windows 11 24H2 mitigations against process hollowing, PureCrypter's developers added a bypass that patches the NtManageHotPatch API in memory. The loader has been used by APT-C-36 (Blind Eagle) and against government entities in Asia-Pacific and North America.
MITRE ATT&CK techniques used in TL-2026-0753
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1622 Debugger Evasion
Discovery
T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery; T1614 System Location Discovery
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
defense-impairment
Affected products and versions in PureCrypter — C# Malware-as-a-Service Loader Distributing
- Microsoft — Windows
Vulnerable versions: 7; 8.1; 10; 11
Remediation for PureCrypter — C# Malware-as-a-Service Loader Distributing
Patches
- No CVE/patch — loader threat; ensure Windows 11 24H2 process-hollowing mitigations are enabled and EDR detects NtManageHotPatch in-memory patching
Immediate actions
- Block listed C2 domains and IP addresses at perimeter/DNS/proxy
- Block or alert on payload retrieval from Discord CDN (cdn.discordapp.com) and transfer.sh from non-business endpoints
- Hunt for the recovered mutex strings and HKCU\...\Run / Winlogon Shell persistence values
- Alert on Set-MpPreference -ExclusionPath usage by non-admin processes
Workarounds
- Application allow-listing to block unsigned .NET loaders from %APPDATA%
- Disable script execution where not required; remove user write access to Startup folders
Longer-term hardening
- Deploy EDR with behavioral detection for process hollowing / RunPE (suspended process creation + remote memory unmapping + thread context manipulation)
- Monitor MSBuild.exe and other LOLBins spawned from user-writable paths or making outbound network connections
- Enable and protect Microsoft Defender tamper protection to prevent exclusion abuse
- Restrict and log script interpreters (PowerShell, VBS, BAT) and scheduled-task creation
Weaknesses (CWE) in PureCrypter — C# Malware-as-a-Service Loader Distributing
CWE-506, CWE-94
Timeline of PureCrypter — C# Malware-as-a-Service Loader Distributing
- PureCrypter first observed in the wild; advertised as a Malware-as-a-Service loader (~$59).
- Active campaigns abusing Discord CDN (cdn.discordapp.com) and transfer.sh to host encrypted PureCrypter payloads delivering SnakeKeylogger and others.
- Peak operational period begins (April–June 2022) with 200+ C2 domains/IPs observed pumping out 10+ malware families.
- Zscaler ThreatLabz publishes technical analysis detailing two-module chain, AES key/IV, Protobuf config, three injection methods, and IOCs.
- 360 Netlab publishes follow-up analysis enumerating 200+ C2 domains/IPs and downloader hashes.
- PureCrypter observed targeting government entities in Asia-Pacific and North America; tied to APT-C-36 (Blind Eagle) usage.
- New campaign chains a .NET loader → Donut loader → PureCrypter to deliver DarkVision RAT, adding Defender exclusions for the payload.
- The Hacker News / Zscaler report the PureCrypter→DarkVision RAT campaign publicly.
- Developers add a Windows 11 24H2 bypass that patches the NtManageHotPatch API in memory to restore process-hollowing injection.
Sources cited for PureCrypter — C# Malware-as-a-Service Loader Distributing
- PureCrypter is busy pumping out various malicious malware families (360 Netlab)
- Technical Analysis of PureCrypter (Zscaler ThreatLabz)
- PureCrypter, Software S9019 (MITRE ATT&CK)
- New Malware Campaign Uses PureCrypter Loader to Deliver DarkVision RAT (The Hacker News / Zscaler)
- PureCrypter: A Fully-Functional Loader Distributing RATs and Infostealers (Cymulate)
- PureCrypter Malware Analysis: 99 Problems but Detection Ain't One (eSentire)
- PureCrypter Loader Detection (SOC Prime)
- PureCrypter Malware Trends (ANY.RUN)
- PureCrypter Malware Targets Government Entities in Asia-Pacific and North America
Threats related to PureCrypter — C# Malware-as-a-Service Loader Distributing
- Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and Lumma Stealer to the Retro Gaming / PlayStation Vita Modding Community
- DesckVB RAT — Google DoubleClick-Abusing Malspam Kit Delivers Fileless .NET Remote Access Trojan (Huntress)
- Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
- TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry
- Millenium RAT v4.x — Native C++ Telegram-Controlled Remote Access Trojan & Infostealer Sold as Malware-as-a-Service (ShinyEnigma)
- SystemBC (Coroxy) Malware: Tor-Based SOCKS5 Proxy Backdoor Enabling Ransomware Persistence and C2 Obfuscation
Detection coverage for TL-2026-0753
As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0753 across Splunk SPL, Microsoft KQL and Sigma, covering 46 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.