Zscaler PureCrypter JUN 2022

PureCrypter has used SmartAssembly and NET-Reactor for string encryption and control flow obfuscation.

PureCrypter can insert junk code to avoid detection.

PureCrypter has used multiple file names to appear legitimate such as firefox\firefox.exe, Google\chrome.exe, and Taskmgr.exe.

PureCrypter has used a .NET downloader named 63342221.BAT and has used .jpg, .png, and .log as false extensions for malicious files.

PureCrypter can inject its final stage into another process on the targeted system.

PureCrypter can execute PowerShell commands to exclude files from EDR and to self-delete.

PureCrypter can execute a PowerShell command to self-delete.

PureCrypter can enumerate a targeted system's SerialNumber and Version.

PureCrypter can use Telegram or Discord to send infection status messages.

PureCrypter can download additional payloads for execution on the compromised host.

PureCrypter can decrypt downloaded resources and parse internal files to determine its settings.

PureCrypter code contains an ExclusionRegionNames option where it can compare the results of `kernel32!GetGeoInfo` with a list of regions.

PureCrypter code contains a global mutex.

PureCrypter can set multiple Registry Run keys to establish persistence.

PureCrypter can send a TLS 1.2 encrypted infection message via Discord webhook.

PureCrypter can use `kernel32!GetGeoInfo` to determine system location.

PureCrypter has the ability to call `CheckRemoteDebuggerPresent`.

PureCrypter can identify virtual machines by querying the WMI object Win32_ComputerSystem for manufacturer and model and check it against the regular expression Microsoft|VMWare|Virtual.

PureCrypter has the ability to delay for a specified number of seconds before execution.

PureCrypter has executed `Set-MpPreference -ExclusionPath` to exclude files or folders from Windows Defender scans.