# PureCrypter — C# Malware-as-a-Service Loader Distributing 10+ Malware Families

> PureCrypter is a C#/.NET Malware-as-a-Service loader (sold from ~$59-60) first observed in March 2021 that uses a two-module downloader-plus-injector chain to deliver 10+ malware families including AgentTesla, RedLine, AsyncRAT, SnakeKeylogger, Remcos, and DarkVision RAT. The injector employs process hollowing and two other injection methods, SmartAssembly obfuscation, AES/DES/RC4 encryption, gzip compression, Protobuf-based configuration, sandbox/VM evasion, and multiple persistence routines, distributed across 200+ C2 domains and IPs.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0753
- **ID:** TL-2026-0753
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 46 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PureCrypter is a commercially sold (Malware-as-a-Service) loader written in C#/.NET, advertised on clearnet for roughly $59-60 and in active use since at least March 2021. It is consumed by many distinct criminal customers to stage and deliver second-stage payloads, and has been observed propagating more than ten malware families: Formbook, AgentTesla, SnakeKeylogger, RedLine Stealer, AsyncRAT, Mars Stealer, Raccoon, Azorult, Remcos, LokiBot, NanoCore, DcRAT, Arkei, WarzoneRAT, PureMiner, PureClipper, and (in 2024) DarkVision RAT.

The loader is delivered via two cooperating modules using a "package" mechanism. The lightly obfuscated Downloader module calls WebClient.DownloadData against hardcoded URIs — frequently abusing reputable file-hosting such as Discord CDN (cdn.discordapp.com) and transfer.sh — to retrieve the heavily obfuscated Injector module. Payloads are protected for transport with a layered scheme: PE header byte-reversal/inversion, gzip/zlib compression (magic 1F 8B 08 00), and symmetric encryption (AES-CBC, DES, or RC4). A fixed AES key (2F820378FEEFBD90987D05D28F0FF0FE) and IV (742CA81F5AC2028E04861092F9F72ECB) have been recovered from samples. The injector's configuration is stored as a Google Protobuf structure, extracted via a "Reverse + GZip + Protobuf.Deserialize" chain, making payloads malleable and resistant to static AV signatures. The binary itself is obfuscated with the commercial SmartAssembly product plus junk-code insertion and encrypted resources.

Before detonation the injector runs execution guardrails: a global mutex (mutual exclusion), configurable delayed execution, WMI environment checks (Win32_BIOS SerialNumber/Version matched against VMware|VIRTUAL|A M I|Xen and Win32_ComputerSystem Manufacturer/Model against Microsoft|VMWare|Virtual), CheckRemoteDebuggerPresent debugger detection, a Sandboxie SbieDLL.dll module check, display-resolution checks, and geolocation-based exclusion regions. It can add Microsoft Defender exclusions via Set-MpPreference -ExclusionPath, perform memory-bombing (allocating 400-500MB regions to thwart sandboxes), and duplicate file handles into explorer.exe for anti-deletion. The injector supports three execution methods selected by config: process hollowing (RunPE — CreateProcessA suspended, ZwUnmapViewOfSection, write payload, set thread context, resume; commonly targeting MSBuild.exe), raw shellcode execution, and in-memory .NET assembly loading/Invoke. Persistence is achieved through HKCU Run keys, a Winlogon Shell modification, Startup-folder drops, and Scheduled Tasks, with masqueraded filenames (svchosts.exe, firefox.exe, chrome.exe, Taskmgr.exe) in decoy directories. Infection status is beaconed to operators over TLS 1.2 via Discord webhooks (WebClient.UploadValues) or the Telegram Bot API. With Windows 11 24H2 mitigations against process hollowing, PureCrypter's developers added a bypass that patches the NtManageHotPatch API in memory. The loader has been used by APT-C-36 (Blind Eagle) and against government entities in Asia-Pacific and North America.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1055 Process Injection
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1480 Execution Guardrails
- T1497 Virtualization/Sandbox Evasion
- T1622 Debugger Evasion
- T1685 Disable or Modify Tools
- T1564 Hide Artifacts
- T1070 Indicator Removal
- T1057 Process Discovery
- T1518 Software Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1033 System Owner/User Discovery
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1573 Encrypted Channel

## Sources

- [PureCrypter is busy pumping out various malicious malware families (360 Netlab)](https://blog.netlab.360.com/purecrypter/)
- [Technical Analysis of PureCrypter (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter)
- [PureCrypter, Software S9019 (MITRE ATT&CK)](https://attack.mitre.org/software/S9019/)
- [New Malware Campaign Uses PureCrypter Loader to Deliver DarkVision RAT (The Hacker News / Zscaler)](https://thehackernews.com/2024/10/new-malware-campaign-uses-purecrypter.html)
- [PureCrypter: A Fully-Functional Loader Distributing RATs and Infostealers (Cymulate)](https://cymulate.com/threats/purecrypter-a-fully-functional-loader-distributing-remote-access-trojans-and-information-stealers/)
- [PureCrypter Malware Analysis: 99 Problems but Detection Ain't One (eSentire)](https://www.esentire.com/blog/pure-crypter-malware-analysis-99-problems-but-detection-aint-one)
- [PureCrypter Loader Detection (SOC Prime)](https://socprime.com/blog/purecrypter-loader-detection-now-upgraded-to-boost-malicious-activity-spreads-remote-access-trojans-and-infostealers/)
- [PureCrypter Malware Trends (ANY.RUN)](https://any.run/malware-trends/purecrypter/)
- [PureCrypter Malware Targets Government Entities in Asia-Pacific and North America](https://csacyber.com/blog/purecrypter-malware-targets-government-entities-in-asia-pacific-and-north-america)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0753