cyber.hendryadrian.com
Detection & Defense · cyber.gov.au

Advisory Explains How Crypter Services Evade Malware Detection

· Original article ↗

Summary

The advisory explains how crypter services obfuscate and encrypt malware to evade detection, including their builder/stub model and counter-antivirus checks, and recommends EDR/HIPS, application control, hardened antivirus settings, and runtime behavioral analysis.

Key points

  • Crypter-as-a-service offerings help cybercriminals, including those with limited technical skills, alter malware to evade detection and can reprocess files after detections appear.
  • Crypter software uses a builder to configure and compile malware and a stub to decrypt and execute its payload; techniques include code obfuscation, polymorphic encryption, process hollowing, and DLL side-loading.
  • The advisory says counter-antivirus services scan crypted files against legitimate antivirus products without sharing results with global threat-intelligence feeds.
  • Crypters may check for virtual machines or debugging and change behavior or stop to avoid analysis; repeated changes can reduce the useful life of file-based detections.
  • Recommended defenses include EDR or HIPS, application control, high-sensitivity heuristic and reputation-based antivirus scanning, regular signature updates, and prompt operating-system patching.
  • For malware that reveals its behavior only at runtime, the advisory recommends memory scanning and behavior-based detections for suspicious memory allocations, reflective code loading, process manipulation, and sandbox-evasion techniques.

Article Details

Defense Focus
Detect malware concealed by crypters by prioritizing runtime behavior and memory analysis over reliance on static signatures alone.
Detection Methods
  • Scan memory at runtime for malicious or suspicious allocations, reflective code loading, and process hollowing or manipulation.
  • Monitor program behavior during execution, including attempts to check for sandboxes or virtual machines and use file padding or junk code.
  • Use high-sensitivity heuristic and reputation-based antivirus scanning alongside signature-based detection.
  • Analyze crypter techniques behaviorally when reverse engineering malware.
Data Sources
  • Runtime process behavior and execution activity
  • Process memory, including suspicious allocations and reflective code loading
  • File contents and signatures
  • File reputation and source trust
Rule Types
  • Behavior-based detection rules for crypter techniques
  • Heuristic antivirus detections
  • Reputation-based antivirus checks
  • Signature-based antivirus rules
Platforms
  • Endpoint Detection and Response (EDR) solutions
  • Host-based Intrusion Prevention System (HIPS) solutions
  • Antivirus software
  • Application control
Defensive Actions
  • Deploy EDR or HIPS on workstations, critical servers, and high-value servers.
  • Enable signature-based and heuristic antivirus detection at high sensitivity, reputation checking, and ransomware protection; update signatures at least daily and schedule regular full-system scans of drives and removable media.
  • Implement application control on workstations, internet-facing servers, and internal servers.
  • Keep operating systems up to date and apply patches promptly.
  • Prioritize runtime memory scanning and behavioral monitoring, including checks for suspicious memory allocations, reflective code loading, and process hollowing or manipulation.
  • Educate users about antivirus limitations and advise caution with attachments and downloads.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationCrypters are described as obfuscating, encrypting, or packing malware files to conceal their contents and evade detection.T1055 · Process InjectionCrypter capabilities include injecting malicious code into legitimate Windows processes.T1055.012 · Process HollowingThe article describes process hollowing as replacing the memory of a newly created suspended process with malicious code before resuming it.T1105 · Ingress Tool TransferDynamic URL payload delivery is listed as a crypter capability for delivering malicious payloads.T1140 · Deobfuscate/Decode Files or InformationThe article describes an unencrypted stub that decrypts the original malware payload when the crypted file runs.T1203 · Exploitation for Client ExecutionThe article describes exploiting Excel vulnerabilities using malicious XLL files as a crypter capability.T1204.002 · Malicious FileIn the fictional case study, employees open the email attachment and execute the crypted malware.T1497.001 · System ChecksThe advisory describes malware checking whether it is running in a virtual machine or sandbox and potentially changing behavior or terminating.T1497.003 · Time Based ChecksThe article describes delaying malicious code execution to help evade detection during initial startup and heuristic analysis.T1548.002 · Bypass User Account ControlBypassing User Account Control is listed among the capabilities offered by crypters.T1566.001 · Spearphishing AttachmentIn the explicitly fictional case study, Jane sends a phishing email with a crypted malware attachment disguised as a trusted supplier's communication.T1574.001 · DLLDLL side-loading is listed as a crypter capability, involving loading a malicious DLL instead of the intended legitimate one.T1620 · Reflective Code LoadingThe advisory recommends detecting reflective code loading during runtime memory analysis of crypted payloads.T1622 · Debugger EvasionThe advisory says some crypters detect whether malware is being debugged and may alter its behavior or terminate.

Related Articles