PureCrypter

Description

PureCrypter is a fully featured malware loader developed by a threat actor called PureCoder and in use since at least 2021 to distribute a variety of remote access trojans and information stealers.

Stats

First seen: October 2022
Last seen: October 2026

Also known as

Purecrypter

MITRE ATT&CK techniques

26 techniques across 6 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.001PowerShell

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.016Junk Code Insertion
- T1027.013Encrypted/Encoded File
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
- T1036.008Masquerade File Type
T1055Process Injection
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information
T1480Execution Guardrails
- T1480.002Mutual Exclusion
T1480Execution Guardrails
- T1480.002Mutual Exclusion
T1564Hide Artifacts
- T1564.003Hidden Window
T1622Debugger Evasion
T1678Delay Execution

TA0007 Discovery

T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1518Software Discovery
- T1518.001Security Software Discovery
T1614System Location Discovery
T1673Virtual Machine Discovery

TA0011 Command and Control

T1102Web Service
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography
- T1573.001Symmetric Cryptography

TA0112 Defense Impairment

T1685Disable or Modify Tools

Associated groups

G0099APT-C-36

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Trojan.Purecrypter	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.PureCrypter	ATP Sandbox Adv. Heuristics
Email-MIME.Trojan.PureCrypter	ATP Sandbox Adv. Heuristics
Gen:Variant.PureCrypter.3	AV
Win32.Exploit.PureCrypter	ATP Sandbox Adv. Heuristics
Win32.Ransomware.PureCrypter	ATP Sandbox Adv. Heuristics
Win32.Trojan.PureCrypter	ATP Sandbox Adv. Heuristics

Related blogs

Threat Labs News Roundup: February 2023

March 7, 20234 min read