PureCrypter — C# Malware-as-a-Service Loader Distributing 10+ Malware Families — Threadlinqs Intelligence
As of 2026-06-10, PureCrypter — C# Malware-as-a-Service Loader Distributing 10+ Malware Families is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 46 indicators of compromise.
Threat ID: TL-2026-0753 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
PureCrypter is a C#/.NET Malware-as-a-Service loader (sold from ~$59-60) first observed in March 2021 that uses a two-module downloader-plus-injector chain to deliver 10+ malware families including
PureCrypter is a commercially sold (Malware-as-a-Service) loader written in C#/.NET, advertised on clearnet for roughly $59-60 and in active use since at least March 2021. It is consumed by many distinct criminal customers to stage and deliver second-stage payloads, and has been observed propagating more than ten malware families: Formbook, AgentTesla, SnakeKeylogger, RedLine Stealer, AsyncRAT, Mars Stealer, Raccoon, Azorult, Remcos, LokiBot, NanoCore, DcRAT, Arkei, WarzoneRAT, PureMiner, PureClipper, and (in 2024) DarkVision RAT.
The loader is delivered via two cooperating modules using a "package" mechanism. The lightly obfuscated Downloader module calls WebClient.DownloadData against hardcoded URIs — frequently abusing reputable file-hosting such as Discord CDN (cdn.discordapp.com) and transfer.sh — to retrieve the heavily obfuscated Injector module. Payloads are protected for transport with a layered scheme: PE header byte-reversal/inversion, gzip/zlib compression (magic 1F 8B 08 00), and symmetric encryption (AES-CBC, DES, or RC4). A fixed AES key (2F820378FEEFBD90987D05D28F0FF0FE) and IV (742CA81F5AC2028E04861092F9F72ECB) have been recovered from samples. The injector's configuration is stored as a Google Protobuf structure, extracted via a "Reverse + GZip + Protobuf.Deserialize" chain, making payloads malleable and resistant to static AV signatures. The binary itself is obfuscated with the commercial SmartAssembly product plus junk-code insertion and encrypted resources.
Before detonation the injector runs execution guardrails: a global mutex (mutual exclusion), configurable delayed execution, WMI environment checks (Win32_BIOS SerialNumber/Version matched against VMware|VIRTUAL|A M I|Xen and Win32_ComputerSystem Manufacturer/Model against Microsoft|VMWare|Virtual), CheckRemoteDebuggerPresent debugger detection, a Sandboxie SbieDLL.dll module check, display-resolution checks, and geolocation-based exclusion regions. It can add Microsoft Defender exclusions via Set-MpPreference -ExclusionPath, perform memory-bombing (allocating 400-500MB regions to thwart sandboxes), and duplicate file handles into explorer.exe for anti-deletion. The injector supports three execution methods selected by config: process hollowing (RunPE — CreateProcessA suspended, ZwUnmapViewOfSection, write payload, set thread context, resume; commonly targeting MSBuild.exe), raw shellcode execution, and in-memory .NET assembly loading/Invoke. Persistence is achieved through HKCU Run keys, a Winlogon Shell modification, Startup-folder drops, and Scheduled Tasks, with masqueraded filenames (svchosts.exe, firefox.exe, chrome.exe, Taskmgr.exe) in decoy directories. Infection status is beaconed to operators over TLS 1.2 via Discord webhooks (WebClient.UploadValues) or the Telegram Bot API. With Windows 11 24H2 mitigations against process hollowing, PureCrypter's developers added a bypass that patches the NtManageHotPatch API in memory. The loader has been used by APT-C-36 (Blind Eagle) and against government entities in Asia-Pacific and North America.
Weaknesses (CWE)
CWE-506, CWE-94
Target sectors: government, technology, financial, manufacturing
Target regions: North America, Asia-Pacific, Europe, South America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 46 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1059, T1547, T1053, T1055, T1140, T1027, T1027, T1036, T1036, T1480