PureCrypter Malware Targets Government Entities in Asia-Pacific and North America

  • Home
  • Blog
  • PureCrypter Malware Targets Government Entities in Asia-Pacific and North America

Executive Summary

An unidentified threat actor was identified by Menlo Labs using Discord to spread an evasive threat campaign that is targeting government institutions through the use of the PureCrypter downloader. The attack is performed through a secondary payload being sent by the PureCrypter campaign using the compromised domain of a non-profit business as a C2 (Command and Control) platform.

Numerous malware strains, including Philadelphia Ransomware, Redline Stealer, AgentTesla, Eternity, and Blackmoon, were discovered to have been distributed by the campaign. 'Menlo's Cloud Security Platform restricted password-protected archive files across several government clients in the Asia-Pacific (APAC) and North American regions'. [1]


Threat actor PureCoder is presently working on a new malware loader called PureCrypter. The loader can distribute a wide variety of malware and is fully featured. 'It has been available for purchase on dark markets since at least March 2021'. On their website, PureCrypter is offered for sale by its creator for $59 for a month of access or $245 for a one-time lifetime purchase. [2]

In order to prevent reverse engineering, crypters are employed as the first line of defence. They are also frequently utilised to conceal dangerous payloads. Along with what PureCrypter describes as an innovative technique to inject the embedded malware into native processes, the programme also offers a number of adjustable parameters to establish persistence on startup and activate other measures to evade detection. [3]

Table 1 - PureCrypter main features. [5]

Event explanation + Potential IOCs (Indicators of Compromise):

A phishing email containing a link to the Discord software, which houses the payload, is used to spread infection.

  • - The PureCrypter loader is downloaded as a result of a malicious password-protected ZIP file that is present in the file.
  • - After being installed, the loader sends the secondary payloads using a compromised domain as a C2 server.
  • - The second phase of malware delivery uses process hollowing to inject the payload into a legitimate process,to evade detection from antivirus tools, this includes malware such as Philadelphia, Redline Stealer, AgentTesla, Eternity, and Blackmoon.
  • - The gathered data is then exfiltrated by the backdoor through a connection, in this case, to a Pakistani FTP server.

Figure 1- Infection chain from attack identified by Menlo. [1]

The campaign's objective appears to be to steal from the victims a variety of sensitive data, including system information. Researchers discovered that in order to minimise their footprint and limit the danger of being identified, the threat actors exploited leaked credentials rather than setting up their own FTP server to take control of the specific host. [4]

Why should you care?

Attacks on civil services (government and businesses) could impact a significant part of the population. Governments and businesses hold a lot of confidential data as well as personal data about everyone, from where you live to the day that you were born, and this information could be stolen if an attack was successful. This information can be used for a whole host of malicious activities.

An attack would have a big impact on the civil services and businesses, governments/ businesses run the country and for them to be attacked would cause them to not only lose revenue but would have knock-on effects on other services in turn. Businesses and people who rely on them might struggle to get the help/ funding they require.

How to protect yourself

As the campaign mainly leverages phishing emails, businesses can implement online safety awareness training. Making sure staff know how to spot phishing emails and how to deal with them is of the utmost importance. Individuals should also educate themselves on the threats that they may face when in the online world and there are lots of resources online where this can be done.

It is crucial to make sure your organisation is prepared for any potential threats. Starting with the basics, such as network and security architecture, the attack surface landscape, and any entry points, think about which, if any, parts of a system an adversary may use to obtain access.

To reduce risks early on, organisations should also look for malicious IPs and other IOCs linked to the campaign, as shown in the appendix. Although researchers continue to track the newest PureCrypter campaign's actions, it is advised that government organisations take the required security precautions to protect their vital infrastructure.

In order to avoid the lateral spreading of any malware, should it be introduced, separate components of the network should be appropriately isolated. Firewall settings and which alerts are configured to trigger an alarm should be assessed. A current anti-virus programme should be installed.

Depending on whether access to systems is necessary, how that access is granted, and the amount of power granted, any customer and supplier may serve as an access or escalation point. Throughout, a limited trust policy should be in place, with access being allowed only as needed and being instantly removed if it is no longer needed.

Secure login portals requiring Multi-Factor Authentication should be present everywhere data is stored or activities involving accounts are performed, such as in customer relationship databases and booking software. Check for vulnerabilities in any code, templates, and plugins on the organization's website if one exists. When accepting card payments, a PCI compliant merchant service should be used. Human aspects shouldn't be disregarded; a straightforward DBS check for employees may reveal suspect intentions or histories.


With the threat of the PureCrypter being used by malicious actors too distribute malware too different entities, it leads for the need of a contingency plan. A contingency plan together with a clear chain of escalation for prompt corrective action to minimise downtime, might guarantee that an organisation remains operational, even if on a limited basis, in the event of an attack.

Due to a lack of IT staff, knowledge, and resources, conducting a thorough audit may be challenging for many small-to-medium businesses. Services provided by Cyber Security Associates range from complete consulting to website analysis.


[1] PureCrypter targets government entities through Discord - Blog | Menlo Security

[2] Technical Analysis of PureCrypter | Zscaler Blog

[3] https://www.malwarebytes.com/blog/news/2015/12/malware-crypters-the-deceptive-first-layer

[4] PureCrypter Loader Found Infecting Government Entities with Various Malware | Cyware Alerts - Hacker News

[5] Researchers Detail PureCrypter Loader Cyber Criminals Using to Distribute Malware (thehackernews.com)

Appendix- IOCs from Menlo’s investigation


Username: ddd@mgcpakistan[.]com







Imphash shared by 106 FTP files:

F34d5f2d4577ed6d9ceec516c1f5a744 (86 files)
61259b55b8912888e90f516ca08dc514 (10 files)

Reg key 82 of the 106 FTP files opened:


Other similar files (MD5):


Would you like to talk to us and find out more about our services?

Please fill in the form below and one of the team will get in touch.