PureCrypterMalware
According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021 The malware has been observed distributing a variety of remote access trojans and information stealers The loader is a.From MISP Galaxy
Last reported 26 days ago, by Huntress5 reports
ATT&CK techniques
6 of 26 · each with the sentence it comes from- T1684Social Engineering
“Threat actors are finding success in this specific abuse of Custom GPTs for social engineering and are continuing to rely on this technique.”
- T1027.009Embedded Payloads
“Its Stage 2 resembles Campaign 2 but differs by dropping multiple embedded payloads from the resource section, including PureRAT, a custom XMRig loader, and PureMiner.”
- T1053.005Scheduled Task
“…ses a legitimate, Canon-signed application to sideload malicious code, then sets up two persistence mechanisms, a User Run key and a scheduled task, both named Canon Configuration Reader.”
- T1055.012Process Hollowing
“T1055.012”
- T1056.001Keylogging
“These plugins could add functionality for anything from microphone/webcam access to real-time keylogging and hidden desktop access.”
- T1027Obfuscated Files or Information
“T1027”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix“It's also not new: a 2025 Lumma Stealer campaign stuffed its payloads into .wav, .mp3, .png and .mp4 files behind a PureCrypter layer, and WAV-hidden payloads are an Octowave Loader trademark.”
-
Booking.com Phishing Campaign Targeting Hotels and Customers“In addition to PureRAT, PureCoder offers other malware, notably the stealer PureLogs (aka zgRAT) and the crypter PureCrypter, both documented during a campaign targeting MSSQL honeypots.”
-
Mallox ransomware affiliate uses PureCrypter in MS-SQL attacks“Mallox ransomware affiliate uses PureCrypter in MS-SQL attacks”
-
Fake Installers to Monero: A Multi-Tool Mining Operation“This campaign build dropped PureRAT v0.3.8B, in which the in-memory PE loader component used a SmartAssembly-protected PureCrypter.”
-
A Vietnamese threat actor's shift from PXA Stealer to PureRAT“PureCrypter – a crypter used to inject malware into legitimate processes, evade detection, and frustrate analysis with anti-VM and anti-debug checks.”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
- sites.google[.]comin 1 report
- rule[.]inin 1 report
- process[.]pidin 1 report
- action.properties[.]companyin 1 report
- d4845669f7f56c6c4eb82147a1f82615in 1 report
- 9bab404584f6a0d9…132fd145dd32in 1 report
- 799e73863806df2964d80d12ce4e61eain 1 report
- headkickscountry[.]comin 1 report
- activatecapagm[.]comin 1 report
- homelycareinc[.]comin 1 report
- byliljedahl[.]comin 1 report
- jamerimprovementsllc[.]comin 1 report
- seedsuccesspath[.]comin 1 report
- zenavuurwerkofficial[.]comin 1 report
- brownsugarcheesecakebar[.]comin 1 report
- hareandhosta[.]comin 1 report
- customvanityco[.]comin 1 report
- ctrlcapaserc[.]comin 1 report
- bknqsercise[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.