PureCrypter is busy pumping out various malicious malware families
<!--kg-card-begin: markdown--><p>In our daily botnet analysis work, it is common to encounter various loaders.Compared to other types of malware, loaders are unique in that they are mainly used to &quot;promote&quot;, i.e., download and run other malware on the infected machine. According to our observations, most loaders are proprietary and have a binding relationship with the family they are promoting. A few loader families make themselves into promotion platforms that can spread any other malware family, achieving the so-called malware-as-a-service (MaaS). Compared with proprietary loaders, MaaS types are obviously more dangerous and should be our primary target of concern.</p>
<p>This article introduces a MaaS type loader we saw a while ago, named PureCrypter, which is very active this year, promoting more than 10 other families and using hundreds of C2s. Zscaler has done a <a href="https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter">detailed sample analysis</a>, this blog mainly introduces the PureCrypter propagation activity we saw from the perspective of C2s and propagation chains to explore the operation of the MaaS type botnet.</p>
<p>The main points of this paper are as follows.</p>
<ul>
<li>PureCrypter is a loader written in C# that has been around since at least 2021 and can propagate any other family.</li>
<li>PureCrypter continues to be active this year and has propagated more than 10 other malware families including Formbook, SnakeKeylogger, AgentTesla, Redline, AsyncRAT, and others.</li>
<li>PureCrypter authors appears to be resourceful, as we have seen hundreds of C2 domains and IPs.</li>
<li>PureCrypter use image name suffixes combined with inversion, compression and encryption to avoid detection.</li>
<li>PureCrypter has a long propagation chain, and most of them use pre-protectors, some times mixed with other loaders, making detection more difficult.</li>
</ul>
<p>In general, the spread of PureCrypter can be summarized in the following figure.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--0--1.png" alt="Image--0--1" loading="lazy"></p>
<p>Now let’s look at the samples and some typical propagation cases below.</p>
<h1 id="sampleanalysis">Sample analysis</h1>
<p>PureCrypter uses the <a href="https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter">package mechanism</a>, which consists of two executables: downloader and injector, both written in C#, where downloader is responsible for propagating the injector, which releases and runs the final payload.</p>
<p>In practice, the attacker generates downloader and injector through builder, and then will try to propagate downloader, which will download and execute injector on the target machine, and then injector will do the rest of the work. In terms of code logic, the downloader module is relatively simple, with a low level of binary obfuscation and no complex operations such as environment detection and persistence, while injector uses common tricks and techniques seen in popular loaders, such as binary obfuscation, runtime environment detection, starting puppet processes, etc. The following is a brief introduction to downloader and injector combined with actual examples.</p>
<h2 id="downloadermodule">downloader module</h2>
<p>This module directly calls WebClient's DownloadData method for HTTP downloads, without setting any HTTP headers.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--11-.png" alt="Image--11-" loading="lazy"></p>
<p>The following is an example of downloading a sample variant with inverted processing, from the parsing code you can see that the HTTP payload is inverted.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--12-.png" alt="Image--12-" loading="lazy"></p>
<p>The inverted PE Header can be found at the end.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--13-.png" alt="Image--13-" loading="lazy"></p>
<p>Finally, the recovered data (.DLL file) is loaded by Assembly.Load, and the entry method of plaintext encoding is called to proceed to the next stage.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--14-.png" alt="Image--14-" loading="lazy"></p>
<p>PureCrypter is relatively simple to protect the injector download, so far, in addition to the above mentioned inverted (reverse) encoding, there are also gzip compression, symmetric encryption, etc. This encoding is fixed, that is, the builder has already determined the encoding method when generating the modules of downloader and injector.</p>
<p>The following is an example of using gzip compression and then transferring the injector, and the magic header of gzip can be found at the beginning: <code>1F 8B 08 00</code>.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--15-.png" alt="Image--15-" loading="lazy"></p>
<p>We have also come across examples where AES encryption is used.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--16-.png" alt="Image--16-" loading="lazy"></p>
<p>In addition to AES, PureCrypter also supports DES, RC4 and other encryption algorithms.</p>
<h2 id="injectormodule">injector module</h2>
<p>If you analyze the injector samples restored by downloader, you will find that the latter are heavily obfuscated. Here is an example of an injector obfuscated by SmartAssembly and partially encrypted with resources.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--17-.png" alt="Image--17-" loading="lazy"></p>
<p>As shown in the figure above, first the relevant configuration information can be got from the combo of Reverse + GZip + Protubuf.Deserialize; then the runtime environment is checked to fight against sandboxing, with mutexes creation and persistence being done based on the configuration; and finally the payload is read from the resource section for loading. The sample does not enter any if statement, and soon reaches the last important function, which mainly implements the final payload injection. 4 injection methods are supported. While which one to use depends on the configuration, Process Hollowing is the most frequently used one.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/image.png" alt="image" loading="lazy"></p>
<p>The final payload is stored in the resource.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--18-.png" alt="Image--18-" loading="lazy"></p>
<p>After reversing and gzip decompression, a puppet process is created to start the final payload.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--19-.png" alt="Image--19-" loading="lazy"></p>
<p>The final payload promoted above is AgentTesla, whose configuration information is as follows.</p>
<pre><code>host: raphaellasia.com
port:587
username: origin@raphaellasia.com
pwd: student@1980
to: origin2022@raphaellasia.com
</code></pre>
<h2 id="accidentaldiscovery">Accidental discovery</h2>
<p>PureCrypter likes to disguise the injector as an image for downloading, the image name is relatively random and has obvious machine generated features. Here are some of the actual detected image names.</p>
<pre><code># pattern 1
/dl/0414/net_Gzhsuovx.bmp
/dl/0528/mars2_Hvvpvuns.bmp
/dl/0528/az_Tsrqixjf.bmp

# pattern 2
/040722/azne_Bvaquebo.bmp
/04122022/net_Ygikzmai.bmp
/04122022/azne_Jzoappuq.bmp
/04122022/pm_Dxjlqugu.bmp
/03252022/azne_Rmpsyfmd.bmp

# pattern 3
/Rrgbu_Xruauocq.png
/Gepstl_Mouktkmu.bmp
/Zhyor_Uavuxobp.png
/Xgjbdziy_Kglkvdfb.png
/Ankwgqtwf_Bdevsqnz.bmp
/Osgyjgne_Ymgrebdt.png
/Rrgbu_Xruauocq.png
/Gepstl_Mouktkmu.bmp
/Osgyjgne_Ymgrebdt.png
/Osgyjgne_Ymgrebdt.png
/Zhyor_Uavuxobp.png

</code></pre>
<p>After analyzing several samples, we found that there is a correspondence between the requested image name and the downloader's AssmblyName.</p>
<table>
<thead>
<tr>
<th>PictureName</th>
<th>AssmblyName</th>
</tr>
</thead>
<tbody>
<tr>
<td>Belcuesth_Ipdtbadv.png</td>
<td>Belcuesth</td>
</tr>
<tr>
<td>Kzzlcne_Prgftuxn.png</td>
<td>Kzzlcne</td>
</tr>
<tr>
<td>newminer2_Jrltkmeh.jpg</td>
<td>newminer2</td>
</tr>
<tr>
<td>Belcuesth_Ipdtbadv.png</td>
<td>Belcuesth</td>
</tr>
<tr>
<td>Nykymad_Bnhmcpqo.bmp</td>
<td>Nykymad</td>
</tr>
<tr>
<td>my_ori_Ywenb_Yzueqpjp.bmp</td>
<td>my ori Ywenb</td>
</tr>
</tbody>
</table>
<p>and the content after the underscore always matches the regular expression</p>
<blockquote>
<p>[A-Z][a-zA-Z]{7}</p>
</blockquote>
<h1 id="c2andpropagationanalysis">C2 and propagation analysis</h1>
<p>PureCrypter has been active this year, and we have detected more than 200 C2 domains and IPs, and more than 10 propagated families. In the cases we have seen, the propagation chain is generally long, and the downloader module of PureCrypter is often used in conjunction with various other types of predecessor downloaders. Because there are too many C2s, here is an introduction to <code>185.215.113.89</code> as an example in terms of scale and propagation methods.</p>
<h2 id="c2analysis">C2 analysis</h2>
<p>This C2 is more active than others among the C2s we detected, and its active time is from mid-April to early June this year, as shown in the figure below.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/xmon_185.215.113.89_ganwang.png" alt="xmon_185.215.113.89_ganwang" loading="lazy"></p>
<p>Its activity level can be reflected visually by our graph system.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/domain_ip_of_butler_202205-1.png" alt="domain_ip_of_butler_202205-1" loading="lazy"></p>
<p>It can be seen that it is associated with more domains and IPs, and the following is part of the IP's domain name resolution during this period.</p>
<pre><code>2022-04-14 22:47:34	2022-07-05 00:42:16	22	rockrock.ug	A	185.215.113.89	
2022-04-21 08:22:03	2022-06-13 09:17:50	15	marnersstyler.ug	A	185.215.113.89	
2022-04-17 03:17:41	2022-06-10 04:31:27	2538	qwertzx.ru	A	185.215.113.89	
2022-04-24 02:16:46	2022-06-09 00:11:24	3	hubvera.ac.ug	A	185.215.113.89	
2022-04-15 23:47:43	2022-06-08 19:24:59	43	timekeeper.ug	A	185.215.113.89	
2022-04-15 11:34:35	2022-06-08 19:24:59	35	boundertime.ru	A	185.215.113.89	
2022-04-14 23:01:50	2022-06-08 15:33:25	24	timebound.ug	A	185.215.113.89	
2022-04-15 21:58:54	2022-06-08 05:43:21	7	www.rockrock.ug	A	185.215.113.89	
2022-04-16 20:50:41	2022-06-08 01:44:01	54	beachwood.ug	A	185.215.113.89	
2022-04-23 16:23:41	2022-06-07 18:30:51	5	asdsadasrdc.ug	A	185.215.113.89	
2022-05-02 22:35:40	2022-06-07 04:34:12	17	leatherlites.ug	A	185.215.113.89	
2022-05-29 17:46:00	2022-06-07 03:50:36	3	underdohg.ac.ug	A	185.215.113.89	
2022-04-15 22:34:53	2022-06-07 03:33:10	18	rockphil.ac.ug	A	185.215.113.89	
2022-04-15 03:09:13	2022-06-07 03:19:50	14	pdshcjvnv.ug	A	185.215.113.89	
2022-04-15 03:04:12	2022-06-07 03:12:04	16	mistitis.ug	A	185.215.113.89	
2022-04-16 03:08:46	2022-06-07 03:08:48	18	nicoslag.ru	A	185.215.113.89	
2022-04-19 02:33:31	2022-06-07 02:37:08	16	danwisha.ac.ug	A	185.215.113.89	
2022-05-28 23:56:02	2022-06-05 05:14:50	7	underdohg.ug	A	185.215.113.89	
2022-05-10 14:44:28	2022-06-02 17:40:12	24	jonescourtney.ac.ug	A	185.215.113.89	
2022-06-02 07:44:25	2022-06-02 07:44:25	1	triathlethe.ug	A	185.215.113.89	
2022-04-24 03:05:38	2022-06-01 16:54:59	2191	qwertasd.ru	A	185.215.113.89	
2022-04-17 09:34:27	2022-06-01 01:42:07	2	partaususd.ru	A	185.215.113.89	
2022-04-25 00:08:53	2022-05-31 07:17:00	5	timecheck.ug	A	185.215.113.89	
2022-04-21 02:36:41	2022-05-31 01:20:37	21	courtneyjones.ac.ug	A	185.215.113.89	
2022-04-16 19:09:02	2022-05-31 01:02:02	14	marksidfgs.ug	A	185.215.113.89	
2022-04-25 03:01:15	2022-05-30 03:04:29	10	mofdold.ug	A	185.215.113.89	
2022-04-15 02:36:21	2022-05-30 02:32:53	17	check-time.ru	A	185.215.113.89	
2022-04-18 02:21:26	2022-05-30 02:22:30	17	agenttt.ac.ug	A	185.215.113.89	
2022-04-17 03:17:46	2022-05-29 03:17:26	15	qd34g34ewdfsf23.ru	A	185.215.113.89	
2022-04-19 02:25:06	2022-05-29 02:22:57	14	andres.ug	A	185.215.113.89	
2022-04-16 02:27:44	2022-05-29 02:22:47	16	asdasgs.ug	A	185.215.113.89	
</code></pre>
<p>From the visits in column 3, differences in the number of visits to these domains can be found, with overall visits in the thousands, and this is only one of the many C2s we see.</p>
<p>Through correlation analysis, we found that <code>185.215.113.89</code> is often used in conjunction with two C2s, <code>62.204.41.69</code> (March) and <code>45.143.201.4</code>(June), and their relationship can be correlated using the chart below.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--21--2.png" alt="Image--21--2" loading="lazy"></p>
<h2 id="propagationanalysis">Propagation analysis</h2>
<p>PureCrypter uses the dual module mechanism of downloader+injector, the former is disseminated and then the latter is disseminated, which is equivalent to adding a link to the dissemination chain, plus the author's usual means to hide the objector by means of fake image, encoding transmission, etc., which is complicated enough in itself.</p>
<p>The author also put a lot of effort in the downloader propagation piece, we see the way through the bat2exe bundled crack software, the use of VBS and powershell script loader, combined with Godzilla front loader and many other ways, the result of these operations superimposed is the spread chain is generally deeper and more complex. In May we even found cases of spreading Raccoon through PureCrypter, which further spread Azorult, Remcos, PureMiner, and PureClipper.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/PC-RACCOON-OTHER.png" alt="PC-RACCOON-OTHER" loading="lazy"></p>
<p>Here are a few typical propagation techniques.</p>
<h3 id="1bat2exepowershellvbsmeteoritepurecrypterspreadingmarsstealer">1, &quot;Bat2Exe+Powershell+VBS+Meteorite+PureCrypter&quot; spreading Mars Stealer</h3>
<p>This is mainly seen in some cracking software, downloader module is bundled to the former for propagation with Bat2Exe. The actual payload files stored in the resource are released to the tmp directory and triggered by the start.bat. The files released in the tmp directory are shaped as follows.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--1-.png" alt="Image--1-" loading="lazy"></p>
<p>The start.bat command takes the shape of：</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--2-.png" alt="Image--2-" loading="lazy"></p>
<p>In the case we analyzed, the .lnk file is used to start the powershell to execute the malicious command.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--3-.png" alt="Image--3-" loading="lazy"></p>
<p>Powershell decodes a base64-encoded VBS loader.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--8-.png" alt="Image--8-" loading="lazy"></p>
<p>The VBS loader further releases a downloader and runs the latter via shellcode. The key information of this downloader is stored in the resource, including the process name and download url, as shown in the image below.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--28-.png" alt="Image--28-" loading="lazy"></p>
<p>The downloader is named Meteorite according to the process name after running, and the url in the above figure corresponds to the downloader module of PureCrypter, and the complete communication process is as follows.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/25e6857acc38482a85b9863f5749d21a-----.png" alt="25e6857acc38482a85b9863f5749d21a-----" loading="lazy"></p>
<p>The final payload is Mars Stealer, c2: <code>rockrock.ug/gggate.php</code>, with the following configuration information:</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--24-.png" alt="Image--24-" loading="lazy"></p>
<h3 id="2vbspowershellpurecrypterpropagatingpureminer">2, &quot;VBS/Powershell + PureCrypter&quot; propagating PureMiner</h3>
<p>The C2 involved is <code>89.34.27.167</code>. The entry can be either a VBS script or a Powershell script, here is an example of VBS script.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--4-.png" alt="Image--4-" loading="lazy"></p>
<p>The network communication traffic is as follows.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/VBS_CASE.png" alt="VBS_CASE" loading="lazy"></p>
<p>Powershell script is as follows.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--25-.png" alt="Image--25-" loading="lazy"></p>
<p>The Powershell script downloads and runs the downloader module of PureCrypter, which proceeds to download the injector, here it is more specific to use Discord to distribute the injector:</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--26-.png" alt="Image--26-" loading="lazy"></p>
<p>The final payload is PureMiner and C2 is as follows:</p>
<pre><code>185.157.160.214
pwn.oracleservice.top
pwn.letmaker.top

port: 8080, 8444
</code></pre>
<h3 id="3unknownnetdownloaderpurecryptertospreadagentteslaredline">3, &quot;unknown .NET downloader + PureCrypter&quot; to spread AgentTesla, RedLine</h3>
<p>The downloader family is unknown, and its runtime is also divided into multiple stages, where the stage0 module is responsible for loading the stage1 malicious module in the resource.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--5-.png" alt="Image--5-" loading="lazy"></p>
<p>The stage1 module will continue to load the next stage module stage2 after running.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--6-.png" alt="Image--6-" loading="lazy"></p>
<p>stage2 module is also a Crypter (not yet named), different from PureCrypter, he also provides a download function, used to download the malicious PureCrypter downloader module, that is, the figure of puty.exe.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--7-.png" alt="Image--7-" loading="lazy"></p>
<p>The malware can be decrypted from the resource with  the key <code>bnvFGkCKlnhQ</code> using  the following algorithm.</p>
<p><img src="__GHOST_URL__/content/images/2022/08/Image--29-.png" alt="Image--29-" loading="lazy"></p>
<p>Two families of binaries are spread. Stage2's payload is AgentTesla with C2:  <code>https[:]//api.telegram.org/bot5421147975:AAGrsGnLOHZfFv7yHuj3hZdQSOVmPodIAVI/sendDocument</code></p>
<p>PureCrypter's payload is RedLine with C2:</p>
<pre><code>IP: workstation2022.ddns.net:62099
ID: cheat
</code></pre>
<h1 id="summary">Summary</h1>
<p>PureCrypter is a MaaS type botnet that is still active and has spread more than 10 other families of payloads, with generally complex spreading practices. There might be a fairly big and resourceful team behind it, so it won’t surprised us if they continuously add and spread other malicious families in the future. We will keep an eye on it and share more information when it is needed.</p>
<h1 id="contactus">Contact us</h1>
<p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a> or email us to <strong>netlab[at]360.cn</strong>.</p>
<h2 id="iocs">IoCs</h2>
<h3 id="md5">MD5</h3>
<table>
<thead>
<tr>
<th>Family Name</th>
<th>MD5</th>
</tr>
</thead>
<tbody>
<tr>
<td>Bat2Exe Downloader</td>
<td>424ed5bcaae063a7724c49cdd93138f5</td>
</tr>
<tr>
<td>VBS downloader</td>
<td>3f20e08daaf34b563227c797b4574743</td>
</tr>
<tr>
<td>Powershell downloader</td>
<td>c4c5167dec23b6dd2d565cd091a279e4</td>
</tr>
<tr>
<td>Unknown .NET Downloader</td>
<td>9b70a337824bac612946da1432295e9c</td>
</tr>
</tbody>
</table>
<h3 id="c2url">C2 &amp;URL</h3>
<pre><code>agenttt.ac.ug
andres.ug
asdasgs.ug
asdsadasrdc.ug
beachwood.ug
boundertime.ru
check-time.ru
courtneyjones.ac.ug
danwisha.ac.ug
hopeforhealth.com.ph
hubvera.ac.ug
jonescourtney.ac.ug
leatherlites.ug
marksidfgs.ug
marnersstyler.ug
mistitis.ug
mofdold.ug
momomolastik.ug
nicoslag.ru
partaususd.ru
pdshcjvnv.ug
qd34g34ewdfsf23.ru
qwertasd.ru
qwertzx.ru
raphaellasia.com
rockphil.ac.ug
rockrock.ug
timebound.ug
timebounder.ru
timecheck.ug
timekeeper.ug
triathlethe.ug
underdohg.ac.ug
underdohg.ug
www.rockrock.ug
212.192.246.195
37.0.11.164:8080
80.66.75.123
89.34.27.167
91.243.44.142
185.215.113.89
62.204.41.69
45.143.201.4
https://cdn.discordapp.com/attachments/994652587494232125/1004377750762704896/ps1-6_Hjuvcier.png
</code></pre>
<!--kg-card-end: markdown-->
In our daily botnet analysis work, it is common to encounter various loaders.Compared to other types of malware, loaders are unique in that they are mainly used to "promote", i.e., download and run other malware on the infected machine. According to our observations, most loaders are proprietary and have a binding relationship with the family they are promoting. A few loader families make themselves into promotion platforms that can spread any other malware family, achieving the so-called malware-as-a-service (MaaS). Compared with proprietary loaders, MaaS types are obviously more dangerous and should be our primary target of concern.


This article introduces a MaaS type loader we saw a while ago, named PureCrypter, which is very active this year, promoting more than 10 other families and using hundreds of C2s. Zscaler has done a detailed sample analysis, this blog mainly introduces the PureCrypter propagation activity we saw from the perspective of C2s and propagation chains to explore the operation of the MaaS type botnet.


The main points of this paper are as follows.


 * PureCrypter is a loader written in C# that has been around since at least 2021 and can propagate any other family.
 * PureCrypter continues to be active this year and has propagated more than 10 other malware families including Formbook, SnakeKeylogger, AgentTesla, Redline, AsyncRAT, and others.
 * PureCrypter authors appears to be resourceful, as we have seen hundreds of C2 domains and IPs.
 * PureCrypter use image name suffixes combined with inversion, compression and encryption to avoid detection.
 * PureCrypter has a long propagation chain, and most of them use pre-protectors, some times mixed with other loaders, making detection more difficult.


In general, the spread of PureCrypter can be summarized in the following figure.





Now let’s look at the samples and some typical propagation cases below.



Sample analysis


PureCrypter uses the package mechanism, which consists of two executables: downloader and injector, both written in C#, where downloader is responsible for propagating the injector, which releases and runs the final payload.


In practice, the attacker generates downloader and injector through builder, and then will try to propagate downloader, which will download and execute injector on the target machine, and then injector will do the rest of the work. In terms of code logic, the downloader module is relatively simple, with a low level of binary obfuscation and no complex operations such as environment detection and persistence, while injector uses common tricks and techniques seen in popular loaders, such as binary obfuscation, runtime environment detection, starting puppet processes, etc. The following is a brief introduction to downloader and injector combined with actual examples.



downloader module


This module directly calls WebClient's DownloadData method for HTTP downloads, without setting any HTTP headers.





The following is an example of downloading a sample variant with inverted processing, from the parsing code you can see that the HTTP payload is inverted.





The inverted PE Header can be found at the end.





Finally, the recovered data (.DLL file) is loaded by Assembly.Load, and the entry method of plaintext encoding is called to proceed to the next stage.





PureCrypter is relatively simple to protect the injector download, so far, in addition to the above mentioned inverted (reverse) encoding, there are also gzip compression, symmetric encryption, etc. This encoding is fixed, that is, the builder has already determined the encoding method when generating the modules of downloader and injector.


The following is an example of using gzip compression and then transferring the injector, and the magic header of gzip can be found at the beginning: 1F 8B 08 00.





We have also come across examples where AES encryption is used.





In addition to AES, PureCrypter also supports DES, RC4 and other encryption algorithms.



injector module


If you analyze the injector samples restored by downloader, you will find that the latter are heavily obfuscated. Here is an example of an injector obfuscated by SmartAssembly and partially encrypted with resources.





As shown in the figure above, first the relevant configuration information can be got from the combo of Reverse + GZip + Protubuf.Deserialize; then the runtime environment is checked to fight against sandboxing, with mutexes creation and persistence being done based on the configuration; and finally the payload is read from the resource section for loading. The sample does not enter any if statement, and soon reaches the last important function, which mainly implements the final payload injection. 4 injection methods are supported. While which one to use depends on the configuration, Process Hollowing is the most frequently used one.





The final payload is stored in the resource.





After reversing and gzip decompression, a puppet process is created to start the final payload.





The final payload promoted above is AgentTesla, whose configuration information is as follows.


host: raphaellasia.com
port:587
username: origin@raphaellasia.com
pwd: student@1980
to: origin2022@raphaellasia.com




Accidental discovery


PureCrypter likes to disguise the injector as an image for downloading, the image name is relatively random and has obvious machine generated features. Here are some of the actual detected image names.


# pattern 1
/dl/0414/net_Gzhsuovx.bmp
/dl/0528/mars2_Hvvpvuns.bmp
/dl/0528/az_Tsrqixjf.bmp

# pattern 2
/040722/azne_Bvaquebo.bmp
/04122022/net_Ygikzmai.bmp
/04122022/azne_Jzoappuq.bmp
/04122022/pm_Dxjlqugu.bmp
/03252022/azne_Rmpsyfmd.bmp

# pattern 3
/Rrgbu_Xruauocq.png
/Gepstl_Mouktkmu.bmp
/Zhyor_Uavuxobp.png
/Xgjbdziy_Kglkvdfb.png
/Ankwgqtwf_Bdevsqnz.bmp
/Osgyjgne_Ymgrebdt.png
/Rrgbu_Xruauocq.png
/Gepstl_Mouktkmu.bmp
/Osgyjgne_Ymgrebdt.png
/Osgyjgne_Ymgrebdt.png
/Zhyor_Uavuxobp.png




After analyzing several samples, we found that there is a correspondence between the requested image name and the downloader's AssmblyName.





PictureName
AssmblyName




Belcuesth_Ipdtbadv.png
Belcuesth


Kzzlcne_Prgftuxn.png
Kzzlcne


newminer2_Jrltkmeh.jpg
newminer2


Belcuesth_Ipdtbadv.png
Belcuesth


Nykymad_Bnhmcpqo.bmp
Nykymad


my_ori_Ywenb_Yzueqpjp.bmp
my ori Ywenb





and the content after the underscore always matches the regular expression





[A-Z][a-zA-Z]{7}




C2 and propagation analysis


PureCrypter has been active this year, and we have detected more than 200 C2 domains and IPs, and more than 10 propagated families. In the cases we have seen, the propagation chain is generally long, and the downloader module of PureCrypter is often used in conjunction with various other types of predecessor downloaders. Because there are too many C2s, here is an introduction to 185.215.113.89 as an example in terms of scale and propagation methods.



C2 analysis


This C2 is more active than others among the C2s we detected, and its active time is from mid-April to early June this year, as shown in the figure below.





Its activity level can be reflected visually by our graph system.





It can be seen that it is associated with more domains and IPs, and the following is part of the IP's domain name resolution during this period.


2022-04-14 22:47:34	2022-07-05 00:42:16	22	rockrock.ug	A	185.215.113.89	
2022-04-21 08:22:03	2022-06-13 09:17:50	15	marnersstyler.ug	A	185.215.113.89	
2022-04-17 03:17:41	2022-06-10 04:31:27	2538	qwertzx.ru	A	185.215.113.89	
2022-04-24 02:16:46	2022-06-09 00:11:24	3	hubvera.ac.ug	A	185.215.113.89	
2022-04-15 23:47:43	2022-06-08 19:24:59	43	timekeeper.ug	A	185.215.113.89	
2022-04-15 11:34:35	2022-06-08 19:24:59	35	boundertime.ru	A	185.215.113.89	
2022-04-14 23:01:50	2022-06-08 15:33:25	24	timebound.ug	A	185.215.113.89	
2022-04-15 21:58:54	2022-06-08 05:43:21	7	www.rockrock.ug	A	185.215.113.89	
2022-04-16 20:50:41	2022-06-08 01:44:01	54	beachwood.ug	A	185.215.113.89	
2022-04-23 16:23:41	2022-06-07 18:30:51	5	asdsadasrdc.ug	A	185.215.113.89	
2022-05-02 22:35:40	2022-06-07 04:34:12	17	leatherlites.ug	A	185.215.113.89	
2022-05-29 17:46:00	2022-06-07 03:50:36	3	underdohg.ac.ug	A	185.215.113.89	
2022-04-15 22:34:53	2022-06-07 03:33:10	18	rockphil.ac.ug	A	185.215.113.89	
2022-04-15 03:09:13	2022-06-07 03:19:50	14	pdshcjvnv.ug	A	185.215.113.89	
2022-04-15 03:04:12	2022-06-07 03:12:04	16	mistitis.ug	A	185.215.113.89	
2022-04-16 03:08:46	2022-06-07 03:08:48	18	nicoslag.ru	A	185.215.113.89	
2022-04-19 02:33:31	2022-06-07 02:37:08	16	danwisha.ac.ug	A	185.215.113.89	
2022-05-28 23:56:02	2022-06-05 05:14:50	7	underdohg.ug	A	185.215.113.89	
2022-05-10 14:44:28	2022-06-02 17:40:12	24	jonescourtney.ac.ug	A	185.215.113.89	
2022-06-02 07:44:25	2022-06-02 07:44:25	1	triathlethe.ug	A	185.215.113.89	
2022-04-24 03:05:38	2022-06-01 16:54:59	2191	qwertasd.ru	A	185.215.113.89	
2022-04-17 09:34:27	2022-06-01 01:42:07	2	partaususd.ru	A	185.215.113.89	
2022-04-25 00:08:53	2022-05-31 07:17:00	5	timecheck.ug	A	185.215.113.89	
2022-04-21 02:36:41	2022-05-31 01:20:37	21	courtneyjones.ac.ug	A	185.215.113.89	
2022-04-16 19:09:02	2022-05-31 01:02:02	14	marksidfgs.ug	A	185.215.113.89	
2022-04-25 03:01:15	2022-05-30 03:04:29	10	mofdold.ug	A	185.215.113.89	
2022-04-15 02:36:21	2022-05-30 02:32:53	17	check-time.ru	A	185.215.113.89	
2022-04-18 02:21:26	2022-05-30 02:22:30	17	agenttt.ac.ug	A	185.215.113.89	
2022-04-17 03:17:46	2022-05-29 03:17:26	15	qd34g34ewdfsf23.ru	A	185.215.113.89	
2022-04-19 02:25:06	2022-05-29 02:22:57	14	andres.ug	A	185.215.113.89	
2022-04-16 02:27:44	2022-05-29 02:22:47	16	asdasgs.ug	A	185.215.113.89	



From the visits in column 3, differences in the number of visits to these domains can be found, with overall visits in the thousands, and this is only one of the many C2s we see.


Through correlation analysis, we found that 185.215.113.89 is often used in conjunction with two C2s, 62.204.41.69 (March) and 45.143.201.4(June), and their relationship can be correlated using the chart below.






Propagation analysis


PureCrypter uses the dual module mechanism of downloader+injector, the former is disseminated and then the latter is disseminated, which is equivalent to adding a link to the dissemination chain, plus the author's usual means to hide the objector by means of fake image, encoding transmission, etc., which is complicated enough in itself.


The author also put a lot of effort in the downloader propagation piece, we see the way through the bat2exe bundled crack software, the use of VBS and powershell script loader, combined with Godzilla front loader and many other ways, the result of these operations superimposed is the spread chain is generally deeper and more complex. In May we even found cases of spreading Raccoon through PureCrypter, which further spread Azorult, Remcos, PureMiner, and PureClipper.





Here are a few typical propagation techniques.



1, "Bat2Exe+Powershell+VBS+Meteorite+PureCrypter" spreading Mars Stealer


This is mainly seen in some cracking software, downloader module is bundled to the former for propagation with Bat2Exe. The actual payload files stored in the resource are released to the tmp directory and triggered by the start.bat. The files released in the tmp directory are shaped as follows.





The start.bat command takes the shape of：





In the case we analyzed, the .lnk file is used to start the powershell to execute the malicious command.





Powershell decodes a base64-encoded VBS loader.





The VBS loader further releases a downloader and runs the latter via shellcode. The key information of this downloader is stored in the resource, including the process name and download url, as shown in the image below.





The downloader is named Meteorite according to the process name after running, and the url in the above figure corresponds to the downloader module of PureCrypter, and the complete communication process is as follows.





The final payload is Mars Stealer, c2: rockrock.ug/gggate.php, with the following configuration information:






2, "VBS/Powershell + PureCrypter" propagating PureMiner


The C2 involved is 89.34.27.167. The entry can be either a VBS script or a Powershell script, here is an example of VBS script.





The network communication traffic is as follows.





Powershell script is as follows.





The Powershell script downloads and runs the downloader module of PureCrypter, which proceeds to download the injector, here it is more specific to use Discord to distribute the injector:





The final payload is PureMiner and C2 is as follows:


185.157.160.214
pwn.oracleservice.top
pwn.letmaker.top

port: 8080, 8444




3, "unknown .NET downloader + PureCrypter" to spread AgentTesla, RedLine


The downloader family is unknown, and its runtime is also divided into multiple stages, where the stage0 module is responsible for loading the stage1 malicious module in the resource.





The stage1 module will continue to load the next stage module stage2 after running.





stage2 module is also a Crypter (not yet named), different from PureCrypter, he also provides a download function, used to download the malicious PureCrypter downloader module, that is, the figure of puty.exe.





The malware can be decrypted from the resource with the key bnvFGkCKlnhQ using the following algorithm.





Two families of binaries are spread. Stage2's payload is AgentTesla with C2: https[:]//api.telegram.org/bot5421147975:AAGrsGnLOHZfFv7yHuj3hZdQSOVmPodIAVI/sendDocument


PureCrypter's payload is RedLine with C2:


IP: workstation2022.ddns.net:62099
ID: cheat




Summary


PureCrypter is a MaaS type botnet that is still active and has spread more than 10 other families of payloads, with generally complex spreading practices. There might be a fairly big and resourceful team behind it, so it won’t surprised us if they continuously add and spread other malicious families in the future. We will keep an eye on it and share more information when it is needed.



Contact us


Readers are always welcomed to reach us on twitter or email us to netlab[at]360.cn.



IoCs



MD5





Family Name
MD5




Bat2Exe Downloader
424ed5bcaae063a7724c49cdd93138f5


VBS downloader
3f20e08daaf34b563227c797b4574743


Powershell downloader
c4c5167dec23b6dd2d565cd091a279e4


Unknown .NET Downloader
9b70a337824bac612946da1432295e9c






C2 &URL


agenttt.ac.ug
andres.ug
asdasgs.ug
asdsadasrdc.ug
beachwood.ug
boundertime.ru
check-time.ru
courtneyjones.ac.ug
danwisha.ac.ug
hopeforhealth.com.ph
hubvera.ac.ug
jonescourtney.ac.ug
leatherlites.ug
marksidfgs.ug
marnersstyler.ug
mistitis.ug
mofdold.ug
momomolastik.ug
nicoslag.ru
partaususd.ru
pdshcjvnv.ug
qd34g34ewdfsf23.ru
qwertasd.ru
qwertzx.ru
raphaellasia.com
rockphil.ac.ug
rockrock.ug
timebound.ug
timebounder.ru
timecheck.ug
timekeeper.ug
triathlethe.ug
underdohg.ac.ug
underdohg.ug
www.rockrock.ug
212.192.246.195
37.0.11.164:8080
80.66.75.123
89.34.27.167
91.243.44.142
185.215.113.89
62.204.41.69
45.143.201.4
https://cdn.discordapp.com/attachments/994652587494232125/1004377750762704896/ps1-6_Hjuvcier.png


{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"In our daily botnet analysis work, it is common to encounter various loaders.Compared to other types of malware, loaders are unique in that they are mainly used to \"promote\", i.e., download and run other malware on the infected machine. According to our observations, most loaders are proprietary and have a binding relationship with the family they are promoting. A few loader families make themselves into promotion platforms that can spread any other malware family, achieving the so-called malware-as-a-service (MaaS). Compared with proprietary loaders, MaaS types are obviously more dangerous and should be our primary target of concern.\n\nThis article introduces a MaaS type loader we saw a while ago, named PureCrypter, which is very active this year, promoting more than 10 other families and using hundreds of C2s. Zscaler has done a [detailed sample analysis](https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter), this blog mainly introduces the PureCrypter propagation activity we saw from the perspective of C2s and propagation chains to explore the operation of the MaaS type botnet.\n\nThe main points of this paper are as follows.\n\n* PureCrypter is a loader written in C# that has been around since at least 2021 and can propagate any other family.\n* PureCrypter continues to be active this year and has propagated more than 10 other malware families including Formbook, SnakeKeylogger, AgentTesla, Redline, AsyncRAT, and others.\n* PureCrypter authors appears to be resourceful, as we have seen hundreds of C2 domains and IPs.\n* PureCrypter use image name suffixes combined with inversion, compression and encryption to avoid detection.\n* PureCrypter has a long propagation chain, and most of them use pre-protectors, some times mixed with other loaders, making detection more difficult.\n\nIn general, the spread of PureCrypter can be summarized in the following figure.\n\n![Image--0--1](__GHOST_URL__/content/images/2022/08/Image--0--1.png)\n\nNow let’s look at the samples and some typical propagation cases below.\n\n# Sample analysis\n\nPureCrypter uses the [package mechanism](https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter), which consists of two executables: downloader and injector, both written in C#, where downloader is responsible for propagating the injector, which releases and runs the final payload. \n\nIn practice, the attacker generates downloader and injector through builder, and then will try to propagate downloader, which will download and execute injector on the target machine, and then injector will do the rest of the work. In terms of code logic, the downloader module is relatively simple, with a low level of binary obfuscation and no complex operations such as environment detection and persistence, while injector uses common tricks and techniques seen in popular loaders, such as binary obfuscation, runtime environment detection, starting puppet processes, etc. The following is a brief introduction to downloader and injector combined with actual examples.\n\n## downloader module\nThis module directly calls WebClient's DownloadData method for HTTP downloads, without setting any HTTP headers.\n\n![Image--11-](__GHOST_URL__/content/images/2022/08/Image--11-.png)\n\nThe following is an example of downloading a sample variant with inverted processing, from the parsing code you can see that the HTTP payload is inverted.\n\n![Image--12-](__GHOST_URL__/content/images/2022/08/Image--12-.png)\n\nThe inverted PE Header can be found at the end.\n\n![Image--13-](__GHOST_URL__/content/images/2022/08/Image--13-.png)\n\nFinally, the recovered data (.DLL file) is loaded by Assembly.Load, and the entry method of plaintext encoding is called to proceed to the next stage.\n\n![Image--14-](__GHOST_URL__/content/images/2022/08/Image--14-.png)\n\nPureCrypter is relatively simple to protect the injector download, so far, in addition to the above mentioned inverted (reverse) encoding, there are also gzip compression, symmetric encryption, etc. This encoding is fixed, that is, the builder has already determined the encoding method when generating the modules of downloader and injector.\n\nThe following is an example of using gzip compression and then transferring the injector, and the magic header of gzip can be found at the beginning: ```1F 8B 08 00```.\n\n![Image--15-](__GHOST_URL__/content/images/2022/08/Image--15-.png)\n\nWe have also come across examples where AES encryption is used.\n\n![Image--16-](__GHOST_URL__/content/images/2022/08/Image--16-.png)\n\nIn addition to AES, PureCrypter also supports DES, RC4 and other encryption algorithms.\n\n## injector module\nIf you analyze the injector samples restored by downloader, you will find that the latter are heavily obfuscated. Here is an example of an injector obfuscated by SmartAssembly and partially encrypted with resources.\n\n![Image--17-](__GHOST_URL__/content/images/2022/08/Image--17-.png)\n\nAs shown in the figure above, first the relevant configuration information can be got from the combo of Reverse + GZip + Protubuf.Deserialize; then the runtime environment is checked to fight against sandboxing, with mutexes creation and persistence being done based on the configuration; and finally the payload is read from the resource section for loading. The sample does not enter any if statement, and soon reaches the last important function, which mainly implements the final payload injection. 4 injection methods are supported. While which one to use depends on the configuration, Process Hollowing is the most frequently used one.\n\n![image](__GHOST_URL__/content/images/2022/08/image.png)\n\nThe final payload is stored in the resource. \n\n![Image--18-](__GHOST_URL__/content/images/2022/08/Image--18-.png)\n\nAfter reversing and gzip decompression, a puppet process is created to start the final payload.\n\n![Image--19-](__GHOST_URL__/content/images/2022/08/Image--19-.png)\n\nThe final payload promoted above is AgentTesla, whose configuration information is as follows.\n```\nhost: raphaellasia.com\nport:587\nusername: origin@raphaellasia.com\npwd: student@1980\nto: origin2022@raphaellasia.com\n```\n\n## Accidental discovery\nPureCrypter likes to disguise the injector as an image for downloading, the image name is relatively random and has obvious machine generated features. Here are some of the actual detected image names.\n```\n# pattern 1\n/dl/0414/net_Gzhsuovx.bmp\n/dl/0528/mars2_Hvvpvuns.bmp\n/dl/0528/az_Tsrqixjf.bmp\n\n# pattern 2\n/040722/azne_Bvaquebo.bmp\n/04122022/net_Ygikzmai.bmp\n/04122022/azne_Jzoappuq.bmp\n/04122022/pm_Dxjlqugu.bmp\n/03252022/azne_Rmpsyfmd.bmp\n\n# pattern 3\n/Rrgbu_Xruauocq.png\n/Gepstl_Mouktkmu.bmp\n/Zhyor_Uavuxobp.png\n/Xgjbdziy_Kglkvdfb.png\n/Ankwgqtwf_Bdevsqnz.bmp\n/Osgyjgne_Ymgrebdt.png\n/Rrgbu_Xruauocq.png\n/Gepstl_Mouktkmu.bmp\n/Osgyjgne_Ymgrebdt.png\n/Osgyjgne_Ymgrebdt.png\n/Zhyor_Uavuxobp.png\n\n```\n\nAfter analyzing several samples, we found that there is a correspondence between the requested image name and the downloader's AssmblyName.\n\n| PictureName | AssmblyName |\n| --- | --- |\n| Belcuesth_Ipdtbadv.png | Belcuesth |\n| Kzzlcne_Prgftuxn.png | Kzzlcne |\n|newminer2_Jrltkmeh.jpg|newminer2|\n| Belcuesth_Ipdtbadv.png|Belcuesth|\n| Nykymad_Bnhmcpqo.bmp | Nykymad|\n|my_ori_Ywenb_Yzueqpjp.bmp | my ori Ywenb|\n\nand the content after the underscore always matches the regular expression\n> [A-Z][a-zA-Z]{7}\n\n# C2 and propagation analysis\nPureCrypter has been active this year, and we have detected more than 200 C2 domains and IPs, and more than 10 propagated families. In the cases we have seen, the propagation chain is generally long, and the downloader module of PureCrypter is often used in conjunction with various other types of predecessor downloaders. Because there are too many C2s, here is an introduction to `185.215.113.89` as an example in terms of scale and propagation methods.\n## C2 analysis\n\nThis C2 is more active than others among the C2s we detected, and its active time is from mid-April to early June this year, as shown in the figure below.\n\n![xmon_185.215.113.89_ganwang](__GHOST_URL__/content/images/2022/08/xmon_185.215.113.89_ganwang.png)\n\nIts activity level can be reflected visually by our graph system.\n\n![domain_ip_of_butler_202205-1](__GHOST_URL__/content/images/2022/08/domain_ip_of_butler_202205-1.png)\n\nIt can be seen that it is associated with more domains and IPs, and the following is part of the IP's domain name resolution during this period.\n```\n2022-04-14 22:47:34\t2022-07-05 00:42:16\t22\trockrock.ug\tA\t185.215.113.89\t\n2022-04-21 08:22:03\t2022-06-13 09:17:50\t15\tmarnersstyler.ug\tA\t185.215.113.89\t\n2022-04-17 03:17:41\t2022-06-10 04:31:27\t2538\tqwertzx.ru\tA\t185.215.113.89\t\n2022-04-24 02:16:46\t2022-06-09 00:11:24\t3\thubvera.ac.ug\tA\t185.215.113.89\t\n2022-04-15 23:47:43\t2022-06-08 19:24:59\t43\ttimekeeper.ug\tA\t185.215.113.89\t\n2022-04-15 11:34:35\t2022-06-08 19:24:59\t35\tboundertime.ru\tA\t185.215.113.89\t\n2022-04-14 23:01:50\t2022-06-08 15:33:25\t24\ttimebound.ug\tA\t185.215.113.89\t\n2022-04-15 21:58:54\t2022-06-08 05:43:21\t7\twww.rockrock.ug\tA\t185.215.113.89\t\n2022-04-16 20:50:41\t2022-06-08 01:44:01\t54\tbeachwood.ug\tA\t185.215.113.89\t\n2022-04-23 16:23:41\t2022-06-07 18:30:51\t5\tasdsadasrdc.ug\tA\t185.215.113.89\t\n2022-05-02 22:35:40\t2022-06-07 04:34:12\t17\tleatherlites.ug\tA\t185.215.113.89\t\n2022-05-29 17:46:00\t2022-06-07 03:50:36\t3\tunderdohg.ac.ug\tA\t185.215.113.89\t\n2022-04-15 22:34:53\t2022-06-07 03:33:10\t18\trockphil.ac.ug\tA\t185.215.113.89\t\n2022-04-15 03:09:13\t2022-06-07 03:19:50\t14\tpdshcjvnv.ug\tA\t185.215.113.89\t\n2022-04-15 03:04:12\t2022-06-07 03:12:04\t16\tmistitis.ug\tA\t185.215.113.89\t\n2022-04-16 03:08:46\t2022-06-07 03:08:48\t18\tnicoslag.ru\tA\t185.215.113.89\t\n2022-04-19 02:33:31\t2022-06-07 02:37:08\t16\tdanwisha.ac.ug\tA\t185.215.113.89\t\n2022-05-28 23:56:02\t2022-06-05 05:14:50\t7\tunderdohg.ug\tA\t185.215.113.89\t\n2022-05-10 14:44:28\t2022-06-02 17:40:12\t24\tjonescourtney.ac.ug\tA\t185.215.113.89\t\n2022-06-02 07:44:25\t2022-06-02 07:44:25\t1\ttriathlethe.ug\tA\t185.215.113.89\t\n2022-04-24 03:05:38\t2022-06-01 16:54:59\t2191\tqwertasd.ru\tA\t185.215.113.89\t\n2022-04-17 09:34:27\t2022-06-01 01:42:07\t2\tpartaususd.ru\tA\t185.215.113.89\t\n2022-04-25 00:08:53\t2022-05-31 07:17:00\t5\ttimecheck.ug\tA\t185.215.113.89\t\n2022-04-21 02:36:41\t2022-05-31 01:20:37\t21\tcourtneyjones.ac.ug\tA\t185.215.113.89\t\n2022-04-16 19:09:02\t2022-05-31 01:02:02\t14\tmarksidfgs.ug\tA\t185.215.113.89\t\n2022-04-25 03:01:15\t2022-05-30 03:04:29\t10\tmofdold.ug\tA\t185.215.113.89\t\n2022-04-15 02:36:21\t2022-05-30 02:32:53\t17\tcheck-time.ru\tA\t185.215.113.89\t\n2022-04-18 02:21:26\t2022-05-30 02:22:30\t17\tagenttt.ac.ug\tA\t185.215.113.89\t\n2022-04-17 03:17:46\t2022-05-29 03:17:26\t15\tqd34g34ewdfsf23.ru\tA\t185.215.113.89\t\n2022-04-19 02:25:06\t2022-05-29 02:22:57\t14\tandres.ug\tA\t185.215.113.89\t\n2022-04-16 02:27:44\t2022-05-29 02:22:47\t16\tasdasgs.ug\tA\t185.215.113.89\t\n```\n\nFrom the visits in column 3, differences in the number of visits to these domains can be found, with overall visits in the thousands, and this is only one of the many C2s we see.\n\nThrough correlation analysis, we found that `185.215.113.89` is often used in conjunction with two C2s, `62.204.41.69` (March) and `45.143.201.4`(June), and their relationship can be correlated using the chart below.\n\n![Image--21--2](__GHOST_URL__/content/images/2022/08/Image--21--2.png)\n\n## Propagation analysis\nPureCrypter uses the dual module mechanism of downloader+injector, the former is disseminated and then the latter is disseminated, which is equivalent to adding a link to the dissemination chain, plus the author's usual means to hide the objector by means of fake image, encoding transmission, etc., which is complicated enough in itself. \n\nThe author also put a lot of effort in the downloader propagation piece, we see the way through the bat2exe bundled crack software, the use of VBS and powershell script loader, combined with Godzilla front loader and many other ways, the result of these operations superimposed is the spread chain is generally deeper and more complex. In May we even found cases of spreading Raccoon through PureCrypter, which further spread Azorult, Remcos, PureMiner, and PureClipper.\n\n![PC-RACCOON-OTHER](__GHOST_URL__/content/images/2022/08/PC-RACCOON-OTHER.png)\n\nHere are a few typical propagation techniques.\n\n### 1, \"Bat2Exe+Powershell+VBS+Meteorite+PureCrypter\" spreading Mars Stealer\nThis is mainly seen in some cracking software, downloader module is bundled to the former for propagation with Bat2Exe. The actual payload files stored in the resource are released to the tmp directory and triggered by the start.bat. The files released in the tmp directory are shaped as follows.\n\n![Image--1-](__GHOST_URL__/content/images/2022/08/Image--1-.png)\n\nThe start.bat command takes the shape of：\n\n![Image--2-](__GHOST_URL__/content/images/2022/08/Image--2-.png)\n\nIn the case we analyzed, the .lnk file is used to start the powershell to execute the malicious command.\n\n![Image--3-](__GHOST_URL__/content/images/2022/08/Image--3-.png)\n\nPowershell decodes a base64-encoded VBS loader.\n\n![Image--8-](__GHOST_URL__/content/images/2022/08/Image--8-.png)\n\nThe VBS loader further releases a downloader and runs the latter via shellcode. The key information of this downloader is stored in the resource, including the process name and download url, as shown in the image below.\n\n![Image--28-](__GHOST_URL__/content/images/2022/08/Image--28-.png)\n\nThe downloader is named Meteorite according to the process name after running, and the url in the above figure corresponds to the downloader module of PureCrypter, and the complete communication process is as follows.\n\n![25e6857acc38482a85b9863f5749d21a-----](__GHOST_URL__/content/images/2022/08/25e6857acc38482a85b9863f5749d21a-----.png)\n\nThe final payload is Mars Stealer, c2: `rockrock.ug/gggate.php`, with the following configuration information:\n\n![Image--24-](__GHOST_URL__/content/images/2022/08/Image--24-.png)\n\n### 2, \"VBS/Powershell + PureCrypter\" propagating PureMiner\nThe C2 involved is `89.34.27.167`. The entry can be either a VBS script or a Powershell script, here is an example of VBS script.\n\n![Image--4-](__GHOST_URL__/content/images/2022/08/Image--4-.png)\n\nThe network communication traffic is as follows.\n\n![VBS_CASE](__GHOST_URL__/content/images/2022/08/VBS_CASE.png)\n\nPowershell script is as follows.\n\n![Image--25-](__GHOST_URL__/content/images/2022/08/Image--25-.png)\n\nThe Powershell script downloads and runs the downloader module of PureCrypter, which proceeds to download the injector, here it is more specific to use Discord to distribute the injector:\n\n![Image--26-](__GHOST_URL__/content/images/2022/08/Image--26-.png)\n\nThe final payload is PureMiner and C2 is as follows:\n```\n185.157.160.214\npwn.oracleservice.top\npwn.letmaker.top\n\nport: 8080, 8444\n```\n\n### 3, \"unknown .NET downloader + PureCrypter\" to spread AgentTesla, RedLine\nThe downloader family is unknown, and its runtime is also divided into multiple stages, where the stage0 module is responsible for loading the stage1 malicious module in the resource.\n\n![Image--5-](__GHOST_URL__/content/images/2022/08/Image--5-.png)\n\nThe stage1 module will continue to load the next stage module stage2 after running.\n\n![Image--6-](__GHOST_URL__/content/images/2022/08/Image--6-.png)\n\nstage2 module is also a Crypter (not yet named), different from PureCrypter, he also provides a download function, used to download the malicious PureCrypter downloader module, that is, the figure of puty.exe.\n\n![Image--7-](__GHOST_URL__/content/images/2022/08/Image--7-.png)\n\nThe malware can be decrypted from the resource with  the key `bnvFGkCKlnhQ` using  the following algorithm.\n\n![Image--29-](__GHOST_URL__/content/images/2022/08/Image--29-.png)\n\nTwo families of binaries are spread. Stage2's payload is AgentTesla with C2:  ```https[:]//api.telegram.org/bot5421147975:AAGrsGnLOHZfFv7yHuj3hZdQSOVmPodIAVI/sendDocument```\n\nPureCrypter's payload is RedLine with C2:\n```\nIP: workstation2022.ddns.net:62099\nID: cheat\n```\n\n# Summary\nPureCrypter is a MaaS type botnet that is still active and has spread more than 10 other families of payloads, with generally complex spreading practices. There might be a fairly big and resourceful team behind it, so it won’t surprised us if they continuously add and spread other malicious families in the future. We will keep an eye on it and share more information when it is needed.\n\n# Contact us\nReaders are always welcomed to reach us on [**twitter**](https://twitter.com/360Netlab) or email us to **netlab[at]360.cn**.\n\n## IoCs\n\n### MD5\n\n| Family Name | MD5 |\n| --- | --- |\n|Bat2Exe Downloader| 424ed5bcaae063a7724c49cdd93138f5|\n|VBS downloader| 3f20e08daaf34b563227c797b4574743|\n|Powershell downloader| c4c5167dec23b6dd2d565cd091a279e4|\n|Unknown .NET Downloader| 9b70a337824bac612946da1432295e9c|\n\n### C2 &URL\n```\nagenttt.ac.ug\nandres.ug\nasdasgs.ug\nasdsadasrdc.ug\nbeachwood.ug\nboundertime.ru\ncheck-time.ru\ncourtneyjones.ac.ug\ndanwisha.ac.ug\nhopeforhealth.com.ph\nhubvera.ac.ug\njonescourtney.ac.ug\nleatherlites.ug\nmarksidfgs.ug\nmarnersstyler.ug\nmistitis.ug\nmofdold.ug\nmomomolastik.ug\nnicoslag.ru\npartaususd.ru\npdshcjvnv.ug\nqd34g34ewdfsf23.ru\nqwertasd.ru\nqwertzx.ru\nraphaellasia.com\nrockphil.ac.ug\nrockrock.ug\ntimebound.ug\ntimebounder.ru\ntimecheck.ug\ntimekeeper.ug\ntriathlethe.ug\nunderdohg.ac.ug\nunderdohg.ug\nwww.rockrock.ug\n212.192.246.195\n37.0.11.164:8080\n80.66.75.123\n89.34.27.167\n91.243.44.142\n185.215.113.89\n62.204.41.69\n45.143.201.4\nhttps://cdn.discordapp.com/attachments/994652587494232125/1004377750762704896/ps1-6_Hjuvcier.png\n```\n"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}