Technical Analysis of PureCrypter

This report analyzes PureCrypter, a SmartAssembly‑obfuscated .NET loader sold since at least March 2021 that downloads and decrypts staged payloads and injects a variety of RATs and stealers (e.g., AgentTesla, RedLine, SnakeKeylogger). The analysis covers its multi-stage downloader and injector, protobuf-driven configuration options (persistence, injection, anti-analysis, Discord/Telegram notifications), resource compression/encryption, multiple injection techniques (process hollowing, shellcode, assembly loading), defensive checks, and provides IoCs and sample hashes used in observed campaigns.