Pure Crypter Deploys Sophisticated Evasion Tactics to Evade Windows 11 24H2 Security Features

eSentire’s Threat Response Unit details Pure Crypter, a commercially marketed malware-as-a-service Windows loader used to deliver infostealers and other payloads. The report covers the loader’s marketplace distribution (forums, Telegram bot), tiered subscription model, GUI and usability, configurable evasion features (AMSI bypass, anti-VM/debug, DLL unhooking), persistence mechanisms, and multiple payload execution methods (RunPE, .NET reflection, shellcode). Notably, operators actively patch the NtManageHotPatch API to bypass Windows 11 24H2 mitigations for process hollowing. eSentire also published analysis tooling (PureCrypterPunisher) to extract Protobufs configurations and aid defenders.