10 minhigh
Malware Crypting Services and the Threat Actors Who Sell Them
Insikt Group analyzed 24 threat actors selling malware crypting services, finding a competitive market that packages defense-evasion tradecraft as commercial products. Three providers are detailed in depth: mrlapis (VIP Crypt) uses a Delphi-based multi-stage loader with manual PE mapping; o1oo1 (ASMCrypt) operates as a HijackLoader builder combining DLL sideloading and staged process injection; ImComplexed employs masquerading, encrypted payload storage, and suspended-process thread-context manipulation. Crypted payloads are designed to defeat static and dynamic analysis, requiring defenders to prioritize behavioral detection over file-based indicators.
Sens:7d
IOCs5
3ip1domain1email
Detection / Hunteropenrouter
What Happened
Criminal groups are selling services that disguise malicious software so it can bypass antivirus programs and security tools. These services, called crypters, take a customer's malware file and encrypt or modify it so that security software cannot recognize it. The researchers examined 24 sellers and found that many now offer additional features like hiding the malware in memory, blocking analysis tools, and automatically re-encrypting files if they get detected. Three sellers are described in detail, each using different technical methods to achieve the same goal. Organizations that rely only on antivirus software are at risk because these services are specifically designed to evade it. Security teams should focus on watching how programs behave when they run, rather than just looking for known bad files.
Key Takeaways
- Crypting services have evolved from basic payload encryption into full malware-enablement platforms offering anti-analysis, process injection, persistence, delivery packaging, and automated recryption.
- 24 crypting service providers were analyzed, with three detailed in depth: mrlapis (VIP Crypt), o1oo1 (ASMCrypt), and ImComplexed, each offering tiered pricing and distinct technical approaches.
- ASMCrypt functions as a builder for HijackLoader packages, combining DLL sideloading, encrypted external configuration, and staged process injection to deliver payloads.
- VIP Crypt uses a Delphi-based multi-stage loader with resource-based storage, segmented data with padding, manual PE mapping, and in-memory execution to conceal embedded payloads.
- Defenders should prioritize behavioral detection over static indicators because crypted payloads are designed to defeat both static and dynamic analysis, with recryption occurring as frequently as every 10 minutes.
Affected Systems
- Windows XP, Windows 7, and later Windows versions (x86 and x64)
- Android devices (APK crypting offered by select providers such as GoldenCrypt and hiddenroot)
- .NET Framework, .NET Core/.NET 5-8 payloads
- Microsoft Defender, SmartScreen, and multiple third-party AV/EDR products (Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Resource Development: Threat actor purchases crypting service from underground marketplace provider, submitting raw payload for encryption
- Initial Access: Crypted payload delivered to victim via phishing attachment, direct link, or packaged delivery format (PDF, MSI, LNK)
- Execution: Loader executes through DLL sideloading via signed application, in-memory decryption, or manual PE mapping without file-backed loading
- Defense Evasion: Anti-VM/anti-sandbox checks, AMSI bypass, ETW patching, syscall unhooking, and Windows Defender exclusion creation suppress security tooling
- Persistence: Registry Run keys, scheduled tasks, services, WMI subscriptions, or AppInit DLLs established to maintain access
- C2: Embedded payload (RAT, stealer, or other malware) executes from injected memory region and communicates with attacker-controlled infrastructure
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article provides behavioral detection guidance and a list of AV process names to monitor, but does not include specific detection rules or query languages. Detection recommendations are described in the Outlook and Recommendations section as behavioral indicators to build detection logic around.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Crypted payloads are designed to evade EDR through syscall unhooking, AMSI bypass, ETW patching, and indirect syscalls. However, behavioral artifacts such as process injection, DLL sideloading, suspended process creation, and thread-context manipulation should still produce EDR telemetry if the product monitors these behaviors. |
| Network Visibility | Low | The article focuses on endpoint evasion and payload delivery. Crypted payloads use FTPS for delivery between buyer and provider, but C2 communication depends on the embedded malware. Network detection would rely on the final payload's C2 protocol rather than crypter-specific behavior. |
| Detection Difficulty | Hard | Crypters specifically target static and dynamic analysis evasion. Recryption cycles as short as 10 minutes invalidate file hashes quickly. Polymorphic code generation, encrypted external configuration, and manual PE mapping reduce the value of static indicators. Detection requires behavioral correlation across multiple telemetry sources and cannot rely on single-event alerts. |
Required Log Sources
- EDR process telemetry with memory access and thread manipulation events
- Sysmon Event ID 1 (Process Creation), Event ID 7 (Image Loaded), Event ID 8 (RemoteThread), Event ID 10 (ProcessAccess)
- Windows Event Log for service creation, scheduled task creation, and registry modification
- File system monitoring for executable creation in %TEMP%, %APPDATA%, %PROGRAMDATA%
- Windows Defender event logs for exclusion creation and tamper protection alerts
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for signed legitimate applications executing from non-standard directories such as %PROGRAMDATA% while loading DLLs from the same working directory, consistent with DLL sideloading behavior described in the ASMCrypt analysis. | EDR process telemetry, Sysmon Event ID 7 (Image Loaded), file path monitoring | Execution | Medium — legitimate software updates or portable applications may exhibit similar DLL loading patterns from non-standard paths. |
| Consider hunting for suspended process creation followed by remote memory writes and thread-context modification, which aligns with the process injection methodology observed in both ASMCrypt and ImComplexed samples. | EDR memory access events, Sysmon Event ID 8 (CreateRemoteThread), Event ID 10 (ProcessAccess) | Defense Evasion | Low — suspended process creation with remote memory writes is uncommon in legitimate software behavior. |
| Consider hunting for Windows Defender exclusion creation that targets root drives, user profiles, or temporary directories, particularly when performed without PowerShell invocation as described in ASMCrypt advertisements. | Windows Defender event logs, registry monitoring for Defender exclusion paths, EDR process telemetry | Defense Evasion | Low to Medium — administrative tools may create exclusions, but root drive or broad path exclusions are atypical. |
| Consider hunting for executables presenting Hyper-V Manager metadata, mutex names, or GUI initialization routines while exhibiting loader behavior such as encrypted resource decoding and in-memory PE mapping, consistent with ImComplexed sample analysis. | EDR process metadata, file reputation services, behavioral analysis of resource access patterns | Execution | Low — legitimate Hyper-V Manager would not exhibit memory allocation, decompression, and suspended child process creation. |
| Consider hunting for high-entropy external configuration files read by executables or DLLs during early-stage execution, as observed in ASMCrypt packages where side-loaded DLLs read encrypted external data. | File system entropy analysis, EDR file access monitoring, Sysmon Event ID 11 (FileCreate) and Event ID 7 (Image Loaded) | Execution | Medium — legitimate applications with encrypted configuration files may produce similar entropy signatures. |
Control Gaps
- Static file hash and signature-based detection is ineffective against crypted payloads due to polymorphic code generation and frequent recryption cycles
- AV-only deployments lack behavioral telemetry needed to detect in-memory execution, manual PE mapping, and process injection
- Public multi-scanner submissions can alert crypter operators and trigger recryption, reducing the shelf life of detection indicators
- Sandbox detonation may fail when anti-VM and anti-analysis checks detect virtualized environments and alter or abort execution
Key Behavioral Indicators
- Signed legitimate application executing from %PROGRAMDATA% or other non-standard directory with DLL loaded from same working directory
- Suspended cmd.exe child process creation followed by remote memory writes and thread-context modification
- Windows Defender exclusion creation targeting root system drive without PowerShell invocation
- Executable masquerading as Hyper-V Manager through metadata, resources, mutex names, and GUI initialization
- High-entropy external configuration files read during early-stage execution by side-loaded DLLs
- Manual PE mapping behavior: memory allocation, header/section copying, import resolution, relocation application, and memory protection changes without file-backed loading
- Process hollowing, APC injection, or reflective .NET assembly loading during staged payload delivery
- Executable with embedded MZ headers or high-entropy resource sections from untrusted sources
False Positive Assessment
Medium — behavioral indicators such as DLL sideloading, suspended process creation, and high-entropy configuration files can occur in legitimate software deployment and update scenarios. Correlation across multiple telemetry sources and baseline comparison is needed to reduce false positives.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing recent endpoint telemetry for behavioral indicators described in the article, including DLL sideloading, suspended process creation with remote memory writes, and Windows Defender exclusion creation.
- Consider isolating hosts where crypted malware execution is suspected, preserving the initial executable, staged artifacts, and memory for forensic analysis.
- Consider auditing existing Windows Defender exclusion policies for broad or root-drive exclusions that may have been created by crypted payloads.
Infrastructure Hardening
- Consider restricting execution from user-writable, temporary, download, and archive extraction paths through application control or allowlisting where supported by your tooling.
- Consider enabling endpoint tamper protection and monitoring for attempted security product disabling, exclusion abuse, or security process termination.
- Consider treating password-protected archives, nested archives, .iso/.vhd/.vhdx files, and shortcut files as high-risk at email and web gateway layers.
- Consider prioritizing private sandboxing or internal detonation over public multi-scanner submissions to avoid alerting crypter operators and triggering recryption.
User Protection
- Consider evaluating whether your EDR solution supports detection of manual PE mapping, reflective loading, and thread-context manipulation behaviors described in the article.
- Consider monitoring for legitimate signed applications running from unusual directories, particularly under %PROGRAMDATA%, if your endpoint tooling provides process ancestry and module loading visibility.
- Consider reviewing persistence mechanisms across registry Run keys, Startup folders, services, and scheduled tasks for entries pointing to executables in temporary or user-writable paths.
Security Awareness
- Consider incorporating guidance on crypted payload delivery formats (PDF-based packaging, CAPTCHA-themed delivery, mass-mailing campaigns) into existing phishing awareness programs.
- Consider reminding users to report unexpected executable attachments, archive files, and shortcut files received via email or download links.
- Consider evaluating whether current security awareness training addresses the limitation of AV-only protection and the importance of behavioral detection for evasive threats.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping21 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Discovery
Tactic
Command and Control
Additional IOCs
- Domains:
exploit[.]im- Jabber messaging service used by mrlapis for customer communication
- Other:
2912CA4F42B6B37C749D759C43340959D5B9DE74E0242B83A3C5CF27FDADAA1DF83038A66255- Tox messaging ID for mrlapis, used as contact method for VIP Crypt crypting service@mrlapis_real- Telegram handle for mrlapis, used as point of contact for VIP Crypt service
Showing defanged values
- domainexploit[.]imJabber messaging service used by mrlapis for customer communication
- emailmrlapis[@]exploit[.]imJabber contact address for mrlapis, used for crypting service inquiries on underground forums
- ip46[.]183[.]217[.]105IP address associated with mrlapis (VIP Crypt provider); resolves to Air VPN exit node in Latvia
- ip5[.]61[.]36[.]246Additional FTPS server previously observed delivering crypted content for mrlapis/VIP Crypt on port 9090
- ip91[.]92[.]242[.]14FTPS server used by mrlapis to deliver crypted payloads to buyers; accessed on port 9090