PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers

PureCrypter is actively being developed by a threat actor using the moniker “PureCoder”.
PureCrypter’s first-stage is a simple downloader. In this example, the downloader was disguised as a fake date console application.
The application secretly downloads a .NET assembly from a command and control server in order to bypass security products. The bytes of the assembly are completely reversed and this same technique is used across PureCrypter’s different stages. The second-stage filename typically has a fake extension such as “jpg”, “png” or “log” and/or a legitimate-looking filename.

The second-stage payload is a more sophisticated piece of code and the core component of PureCrypter. On top of that, the .NET assembly is obfuscated with the commercial tool SmartAssembly.
As part of the SmartAssembly’s obfuscation, the module entrypoint first adds an assembly and a resource resolver. An extra assembly resolver is added to handle compressed and/or encrypted data. Basically, when an assembly is referenced the resolver will capture that event and try to load the assembly from its resources.

The main function of the PureCrypter injector starts by reversing, decompressing (gunzip) and deserializing an object into the following protocol buffer (protobuf).
The author of PureCrypter provided an option to send an infection status message on a Discord channel. Using the the DiscordWebHookUrl parameter, the malware can send the dictionary in Table 3 via the WebClient:UploadValues method over TLS 1.2.
New variants of the malware can send a similar message to the author via Telegram. The URL is constructed as follows:
https://api.telegram.org/bot + protobuf_configuration.TelegramToken + /sendMessage?chat_id= + protobuf_configuration.TelegramID.
The message is sent via WebClient:DownloadString over TLS 1.2

Given the StartupSettings members, the PureCrypter injector can achieve persistence using different methods.
Firstly, it takes the Location member as a parameter to the Environment.GetFolderPath method. In this case, it retrieves the %APPDATA% folder and appends the value of the FileName member to it.
The EnumStartup field indicates how to install the malware on the system.
The PureCrypter developer provides three different ways to run the associated malware, which is given by the EnumInjection member. However, all of them retrieve the embedded malicious payload by decompressing and reversing one of the resources mentioned earlier.

Process Hollowing
The process hollowing technique is pretty classic and comes in 32 and 64-bit flavors.
PureCrypter starts by creating a suspended process via CreateProcessA(). The command-line argument is built by concatenating the result of GetRuntimeDirectory(), the InjectionPath and an “.exe” extension. If the CommandLine struct member is set, then it is also concatenated. The remote process memory is unmapped via ZwUnmapViewOfSection() and the associated malware is written to the process memory and executed.

Shellcode
The injector can also run the embedded resource inside its own process by creating a shellcode.

Assembly Loading
The last way the PureCrypter injector can run its payload is by loading the resource as an assembly and invoking its entrypoint.

Extra Anti-* functionalities
Some methods that don’t seem to be referenced, but still are quite interesting in terms of environment detection are the following:

Queries the WMI object Win32_BIOS for the computer’s SerialNumber and Version and checks if it matches the regular expression “VMware|VIRTUAL|A M I|Xen”
Queries the WMI object Win32_ComputerSystem for the computer’s Manufacturer and Model and checks if it matches the regular expression “Microsoft|VMWare|Virtual”
Calls CheckRemoteDebuggerPresent
Checks for the presence of “SbieDLL.dll” module
Checks specific resolutions of the display monitor

Injected code
The sample delivers a SnakeKeylogger variant.
This malware family is just one of many payloads observed by ThreatLabz that is injected via a process hollowing technique

Sign Up For Threat Alerts

Loading...
Threats Icon

Dec 01, 2022

UNC4191 Threat Group Targets Entities In The...

The UNC4191 threat group was discovered targeting entities in the Philippines with custom malware and...

Threats Icon

Nov 30, 2022

Emotet Leads To Quantum Ransomware Infection

Threat actors were observed using Emotet to gain access to the victim's network and deploy...

Threats Icon

Nov 29, 2022

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that...

Threats Icon

Nov 29, 2022

Ransomware Roundup: Cryptonite Ransomware

FortiGuard Labs has reported on Cryptonite ransomware, which was found to target Microsoft Windows machines...

Threats Icon

Nov 28, 2022

Operation Typhoon: The Cyber Sea Lotus Coveting...

Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions...

Threats Icon

Nov 27, 2022

IL-Cert Alert – Active phishing campaign in...

There is a new phishing campaign in Israel. The malware relies upon user execution. The...

Threats Icon

Nov 27, 2022

Emotets Vacation Is Over: No Rest For...

Emotet started as a banking Trojan in spreading via spam campaigns by imitating financial statements,...

Threats Icon

Nov 24, 2022

Aurora: A Rising Stealer Flying Under The...

Aurora is a multipurpose botnet with data collection, information stealer, downloading, and remote access Trojan...

Threats Icon

Nov 23, 2022

Analysis Of The ViperSoftX And VenomSoftX Information...

Torrents and software-sharing sites are being used to target victims across the globe with variants...

Threats Icon

Nov 22, 2022

Wipermania

Wipers have existed for years, and while they haven't been utilized as much as ransomware,...

Threats Icon

Nov 21, 2022

LockBit 3.0 Ransomware Unlocked

Also known as LockBit Black, this ransomware family announced itself stating that it would now...

Threats Icon

Nov 21, 2022

Control Panel Executable Abused For QakBot Infection

QakBot campaign modifies deployment tactics and aims to exploit a DLL hijacking technique that abuses...

Threats Icon

Nov 20, 2022

Earth Preta Spear-Phishing Governments Worldwide

Trend Micro teams have been monitoring a wave of spear-phishing attacks targeting the government, academic,...

Threats Icon

Nov 20, 2022

CISA Alert (AA22-321A) – Hive Ransomware Analysis

Threat actors are using Hive ransomware variants to target the government, communication, critical manufacturing, information...

Threats Icon

Nov 16, 2022

DTrack activity targeting Europe and Latin America

DTrack is a backdoor used by the Lazarus group. It is used by the Lazarus...