Report Details How Malware Crypting Services Help Threat Actors Evade Detection
Summary
Recorded Future analyzed 24 crypting providers and found services combining payload obfuscation with loaders, anti-analysis, persistence, and evasion features. It recommends behavior-based detection and response instead of relying on signatures or antivirus alone.
Key points
- Insikt Group examined 24 providers active within the past year; their services are marketed through underground forums, chat platforms, websites, and social media.
- Providers package payload encryption and obfuscation with features such as in-memory execution, process injection, anti-analysis checks, persistence, and repeated re-crypting after detection.
- The services primarily target Windows payloads; the report found no advertising for macOS or Linux crypting services.
- Sample analysis describes multi-stage loaders using techniques including manual PE mapping, DLL sideloading, encrypted configuration, process injection, and staged in-memory execution.
- Provider claims about antivirus and EDR evasion should be treated as unverified unless corroborated by sample analysis or other evidence.
- Crypting makes malware harder to detect and analyze but does not itself provide end-to-end intrusion capability; subsequent activity depends on the embedded malware and operator.
- Defenders should prioritize behavioral monitoring for security-tool tampering, suspicious staging and process chains, in-memory loading, and persistence, while preserving artifacts and isolating affected hosts when warranted.
Article Details
- Publisher
- Recorded Future
- Report Period
- Past year
- Scope
- Advertised crypting services, provider reputations, malware relationships, and technical analysis of selected crypted samples.
- Sample Size
- 24 crypting service or product providers
- Key Statistics
- Insikt Group analyzed 24 providers, including three profiled in detail and 21 listed in Appendix A.
- mrlapis advertised VIP Crypt at $500 per week, with automatic re-encryption every ten minutes.
- o1oo1 advertised ASMCrypt at $3,000 per month, discounted to $2,000 per month for customers renting TOP RAT at $5,000 per month.
- ImComplexed advertised a $1,000 one-time crypt, monthly plans at $2,500 and $6,000, and premium packages at $12,000 and $20,000.
- mrlapis claimed that crypting a Remcos RAT sample reduced detections from 18/25 to 0/25 on avcheck[.]net and from 11/21 to 1/21 on scanner[.]to; these were operator-advertised results.
- Recommendations
- Prioritize behavioral detection and correlated endpoint telemetry for DLL sideloading, manual PE mapping, process injection, unusual child processes, and persistence rather than relying on hashes or AV detections alone.
- Restrict execution from user-writable, temporary, download, and archive-extraction paths through application control or allowlisting.
- Enable endpoint tamper protection and monitor security-product disabling, exclusion creation, security-process termination, and interference with security tooling.
- Isolate suspected affected hosts, preserve executables, staged artifacts, memory and process telemetry, and investigate persistence, final payloads, command-and-control activity, and follow-on compromise.
- Prefer private sandboxing, internal detonation, or trusted intelligence-sharing channels; public multi-scanner submissions can alert crypter operators and prompt recryption.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 46[.]183[.]217[.]105 | IP associated with mrlapis by Insikt Group; the source identifies it as an Air VPN exit node in Latvia, not necessarily actor-owned infrastructure. |
| IPV4 | 5[.]61[.]36[.]246 | Previously observed FTPS server used by mrlapis to disseminate crypted content on port 9090. |
| IPV4 | 91[.]92[.]242[.]14 | FTPS server identified by Insikt Group as used by mrlapis to deliver crypted payloads on port 9090. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationCrypting services encrypt and obfuscate payloads to hinder detection and analysis.T1027.002 · Software PackingProviders advertise payload packing, and analyzed loaders reconstruct protected payloads at runtime.T1027.009 · Embedded PayloadsAnalyzed loaders conceal embedded payloads in resources and protected stages.T1027.012 · LNK Icon SmugglingAppendix B explicitly maps LNK Icon Smuggling.T1027.013 · Encrypted/Encoded FileAdvertisements and sample analysis describe encrypted payloads and external encrypted configuration.T1027.016 · Junk Code InsertionProviders advertise junk-code insertion; VIP Crypt analysis identified non-functional padding.T1053 · Scheduled Task/JobScheduled tasks are advertised as optional persistence mechanisms.T1053.005 · Scheduled TaskProviders advertise Windows scheduled tasks as persistence options.T1055 · Process InjectionProviders advertise process injection; analyzed samples exhibit remote memory writes and thread-context manipulation.T1055.001 · Dynamic-link Library InjectionProviders advertise DLL injection.T1055.004 · Asynchronous Procedure CallProviders advertise asynchronous procedure call injection.T1055.012 · Process HollowingProviders, including mrlapis, advertise process hollowing.T1059 · Command and Scripting InterpreterAppendix B maps command and scripting interpreter execution; advertisements support script-based payload formats.T1059.001 · PowerShellAppendix B explicitly maps PowerShell execution.T1059.003 · Windows Command ShellAnalyzed ImComplexed samples launch a hidden, suspended CMD.exe process.T1071 · Application Layer ProtocolAppendix B maps application-layer protocols, including FTPS payload-transfer infrastructure.T1071.002 · File Transfer Protocolsmrlapis uses FTPS servers to transfer crypted payloads to customers.T1102 · Web ServiceAppendix B maps web services used in the crypting ecosystem's delivery infrastructure.T1105 · Ingress Tool TransferAppendix B maps payload transfer; the report documents delivery of crypted files through FTPS servers.T1137 · Office Application StartupProviders advertise Office COM add-ins for persistence.T1137.006 · Add-insAdvertisements include Office COM add-ins.T1197 · BITS JobsBITS jobs are listed as advertised persistence options.T1204 · User ExecutionAppendix B maps user execution associated with packaged malicious files.T1204.002 · Malicious FileAppendix B maps execution of malicious files delivered through advertised payload packaging.T1497 · Virtualization/Sandbox EvasionProviders advertise virtual-machine, debugger, and sandbox execution restrictions.T1497.001 · System ChecksASMCrypt advertises checks for RAM, CPU, hypervisors, system names, MAC addresses, and GPU names.T1497.003 · Time Based ChecksProviders advertise execution delays, sleep obfuscation, and timing checks to evade analysis.T1518 · Software DiscoveryAppendix B maps software discovery associated with loader environment checks.T1518.001 · Security Software DiscoveryHijackLoader reporting describes security-product detection that modifies execution behavior.T1543 · Create or Modify System ProcessProviders advertise creating Windows services for persistence.T1543.003 · Windows ServiceAdvertisements include Windows services for persistence.T1546 · Event Triggered ExecutionProviders advertise event-triggered persistence mechanisms, including WMI subscriptions and COM hijacking.T1546.002 · ScreensaverAppendix B explicitly maps screensaver-based persistence.T1546.003 · Windows Management Instrumentation Event SubscriptionAdvertisements include WMI event subscriptions.T1546.007 · Netsh Helper DLLAdvertisements include Netsh helper DLLs.T1546.010 · AppInit DLLsAdvertisements include AppInit DLLs for persistence.T1546.012 · Image File Execution Options InjectionAdvertisements include Image File Execution Options Debugger entries.T1546.013 · PowerShell ProfileAdvertisements include PowerShell profiles for persistence.T1546.015 · Component Object Model HijackingAdvertisements include COM hijacking for persistence.T1547 · Boot or Logon Autostart ExecutionProviders advertise multiple boot or logon autostart mechanisms.T1547.001 · Registry Run Keys / Startup FolderAdvertisements include Registry Run keys and Startup Folder entries.T1547.002 · Authentication PackageAdvertisements include Local Security Authority Security Package registration.T1547.004 · Winlogon Helper DLLAdvertisements include Winlogon Shell modification.T1547.005 · Security Support ProviderAdvertisements include Security Support Provider registration.T1547.008 · LSASS DriverAppendix B explicitly maps LSASS Driver persistence.T1547.009 · Shortcut ModificationAppendix B explicitly maps shortcut modification.T1547.010 · Port MonitorsAdvertisements include Print Monitor DLLs for persistence.T1548 · Abuse Elevation Control MechanismProviders advertise elevation and UAC-related capabilities.T1548.002 · Bypass User Account ControlImComplexed and Namzcrypter advertise UAC exploit or bypass capabilities; these are provider claims.T1553 · Subvert Trust ControlsProviders advertise code signing to improve payload trust and bypass security warnings.T1553.002 · Code SigningProviders advertise signing malicious executables with EV certificates.T1566 · PhishingProviders advertise payload packaging tailored to phishing and social engineering.T1566.001 · Spearphishing AttachmentAdvertisements include document, archive, and executable packaging suitable for phishing attachments.T1566.002 · Spearphishing LinkAdvertisements include mass-mailing links and direct-link payload delivery.T1574 · Hijack Execution FlowAdvertised and analyzed loaders use DLL sideloading and DLL or COM hijacking.T1574.001 · DLLAnalyzed ASMCrypt packages load attacker-controlled DLLs through legitimate signed applications.T1583 · Acquire InfrastructureAppendix B maps acquisition of infrastructure supporting crypting services.T1583.004 · ServerAppendix B maps server acquisition; the report describes provider-operated payload-transfer servers.T1583.006 · Web ServicesAppendix B maps acquisition of web services for crypting-related infrastructure.T1587 · Develop CapabilitiesAppendix B maps development of malware-enablement capabilities.T1587.001 · MalwareAppendix B maps malware development within the crypting ecosystem.T1587.002 · Code Signing CertificatesAppendix B maps development of code-signing certificates associated with advertised signing capabilities.T1588 · Obtain CapabilitiesAppendix B maps obtaining malware, tools, and code-signing certificates.T1588.001 · MalwareAppendix B maps obtaining malware; providers sell or support commodity malware payloads.T1588.002 · ToolCrypting tools are sold to customers for payload protection and evasion.T1588.003 · Code Signing CertificatesProviders advertise obtaining EV code-signing certificates to improve payload trust.T1608 · Stage CapabilitiesAppendix B maps staging capabilities, including uploading malware.T1608.001 · Upload MalwareProviders stage crypted payloads on transfer infrastructure for customer delivery.T1620 · Reflective Code LoadingProviders advertise reflective loading; analyzed VIP Crypt samples manually map embedded PE payloads in memory.
Threat Actors
Malware
Agent TeslaThere may be a relationship between esco and Agent Tesla, based on a Malwarebytes report.AlbirioxFor instance, a well-established crypting service provider on underground forums, “GoldenCrypt”, is reportedly affiliated (1, 2, 3) with multiple malware families, including FvncBot, Albiriox, and Mirax.AURA StealerThere may be a relationship between AURA Stealer and DefCrypt, based on forum posts.BianLianOpen-source reporting suggests a possible direct relationship between hiddenroot and BianLian developers.FvncBotFor instance, a well-established crypting service provider on underground forums, “GoldenCrypt”, is reportedly affiliated (1, 2, 3) with multiple malware families, including FvncBot, Albiriox, and Mirax.HIJACKLOADERAs discussed in the next section, ASMCrypt serves as a builder for HijackLoader (also known as IDAT Loader) packages, which is how it obfuscates payloads.IDAT LoaderAs discussed in the next section, ASMCrypt serves as a builder for HijackLoader (also known as IDAT Loader) packages, which is how it obfuscates payloads.MiraxFor instance, a well-established crypting service provider on underground forums, “GoldenCrypt”, is reportedly affiliated (1, 2, 3) with multiple malware families, including FvncBot, Albiriox, and Mirax.Netwire RATThe threat actor has also advertised Netwire RAT, claiming to provide video proof of Windows Defender bypass.PureRatFor instance, in July 2025, eSentire reported an association between PureRAT, a remote access trojan (RAT) first advertised in January 2023, and GhostCrypt, a crypting service sold by an underground forum member of theRemcos RATthe crypting service’s capabilities across multiple malware families, including Rhadamanthys and Remcos RAT.Rhadamanthysthe years discussing the crypting service’s capabilities across multiple malware families, including Rhadamanthys and Remcos RAT.SnappyClientThe threat actor has been observed selling the malware encryption tool ASMCrypt and TOP RAT (aka SnappyClient), a commodity RAT first offered in September 2025.SPECTRE BOTIn the same post, ImComplexed promoted a "SPECTRE BOT Runtime Test" conducted with an active control panel and live internet connectivity.TOP RATThe threat actor has been observed selling the malware encryption tool ASMCrypt and TOP RAT (aka SnappyClient), a commodity RAT first offered in September 2025.TrickBotBentley is officially affiliated with Trickbot and has been implicated in developing and administering Conti, according to leaked chats.
Vendors
Air VPNThis IP address is associated with the privacy-focused VPN service Air VPN and has an exit node in Latvia.AvastOther named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender.AVGOther named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender.BitdefenderOther named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender.Carbon BlackOther named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender.CrowdStrikeOther named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender.Emsisoftmrlapis also advertised additional updates, including runtime bypasses for AVG, Avast, Emsisoft, and Ikarus; a universal runtime bypass; process hollowing; indirect syscall-based EDR bypass; and support for crypting x64ESETOther named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender.Ikarusmrlapis also advertised additional updates, including runtime bypasses for AVG, Avast, Emsisoft, and Ikarus; a universal runtime bypass; process hollowing; indirect syscall-based EDR bypass; and support for crypting x64KasperskyOther named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender.MalwarebytesOther named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender.MicrosoftCrypter providers most often market their services or crypter products as FUD or “bypass” offerings, with frequent references to evading Microsoft Defender, SmartScreen, AV products, and EDR tools.NortonOther named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender.Recorded FutureFigure 1: MITRE ATT&CK Enterprise tactics and techniques described in crypting advertisements (Source: Recorded Future)SentinelOneOther named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender.SymantecNorton/SymantecTrend MicroOther named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender.
Products
AndroidClaims Google Play Protect evasion through APK obfuscation, trusted code-signing certificate, Android manifest morphing, Smali code and string obfuscation, resource renaming, optional junk code insertion, AVAnyDeskThe complainant also alleges that, rather than delivering the agreed-upon files, the seller insisted on using AnyDesk to access the buyer's VPS, which was not part of the original agreement.Chrome Alertmrlapis also advertised that VIPCrypt 3.0 bypassed Windows Defender and Chrome Alert; did not use .NET or a dropper; supported payload generation for Windows XP, Windows 7, and later Windows versions; and could provideEdgecleaning for submitted samples that could be retrieved from cloud infrastructure, during Chrome or Edge downloads, and from virtual private servers (VPS) in customer-selected countries.Google Chromemrlapis also advertised that VIPCrypt 3.0 bypassed Windows Defender and Chrome Alert; did not use .NET or a dropper; supported payload generation for Windows XP, Windows 7, and later Windows versions; and could provideGoogle ChromeClaims guaranteed Microsoft Defender evasion, Google Chrome and Microsoft SmartScreen bypass, and use of an EV code-signing certificate to improve payload trustworthinessGoogle Play ProtectClaims Google Play Protect evasion through APK obfuscation, trusted code-signing certificate, Android manifest morphing, Smali code and string obfuscation, resource renaming, optional junk code insertion, AVHyper-V ManagerThe analyzed samples present a Hyper-V Manager facade through application metadata, resources, strings, mutex names, and graphical user interface (GUI) initialization routines.Microsoft DefenderCrypter providers most often market their services or crypter products as FUD or “bypass” offerings, with frequent references to evading Microsoft Defender, SmartScreen, AV products, and EDR tools.Microsoft SmartScreenClaims guaranteed Microsoft Defender evasion, Google Chrome and Microsoft SmartScreen bypass, and use of an EV code-signing certificate to improve payload trustworthinessMicrosoft WindowsInsikt Group analyzed 24 threat actors advertising crypting services and products within the past year and identified a market that is competitive, reputation-driven, and heavily focused on Windows payloads.Microsoft Windowsupdates and refinements, including multiple updates to operate effectively across every version of Microsoft Windows and to effectively bypass Windows-native AV solutions.Mozilla FirefoxDetection-evasion claims, including Windows Defender, SmartScreen, Chrome/Edge/Firefox warning bypasses, long-duration FUD, and EV-certificate-based signing claimsRecorded Future’s Malware AnalysisImplementing Recorded Future’s Malware Analysis to investigate malicious crypted samples and to hunt for additional context associated with the sample; using artifacts, patterns, and IoCs associated with the activity toSmartScreenCrypter providers most often market their services or crypter products as FUD or “bypass” offerings, with frequent references to evading Microsoft Defender, SmartScreen, AV products, and EDR tools.Ubuntu 22.04/24.04archive distribution for EV-certificate builds requiring DLLs, and VPS requirements using Ubuntu 22.04/24.04 or Windows Server 2012 R2Windows 7Defender and Chrome Alert; did not use .NET or a dropper; supported payload generation for Windows XP, Windows 7, and later Windows versions; and could provide encrypted files through FTPS with automatic cryptingWindows Defenderto the advertisements, crypters often implement additional anti-analysis capabilities, such as Windows Defender and SmartScreen bypasses, AV-kill functionality, protected registry keys, AMSI bypass, Event TracingWindows Defender Cloudalleges that their crypted outputs are still FUD, advertising FUD statuses for avcheck and Windows Defender Cloud, without requiring extended validation (EV) code-signing certificates.Windows Server 2012 R2for EV-certificate builds requiring DLLs, and VPS requirements using Ubuntu 22.04/24.04 or Windows Server 2012 R2Windows XPWindows Defender and Chrome Alert; did not use .NET or a dropper; supported payload generation for Windows XP, Windows 7, and later Windows versions; and could provide encrypted files through FTPS with automatic
Tools
ASMCryptThe threat actor has been observed selling the malware encryption tool ASMCrypt and TOP RAT (aka SnappyClient), a commodity RAT first offered in September 2025.GhostCryptan association between PureRAT, a remote access trojan (RAT) first advertised in January 2023, and GhostCrypt, a crypting service sold by an underground forum member of the same moniker, in an attack that impactedKGBCryptermultiple potential links between WDKiller and various malware families; however, while WDKiller and “KGBCrypter” are referenced as delivering these families, there is no solid link between these families and theKleenScanthe assertion that their payloads are FUD by using multi-AV platforms, the most common of which is KleenScan, a service that allows threat actors to scan samples without storing and potentially exposing theThemidaTechnical requirements and qualifications include a preference for clean, unpacked files over UPX-, Themida-, or VMProtect-protected inputs; Windows compatibility, including newer builds; special handling for MemoryUPXTechnical requirements and qualifications include a preference for clean, unpacked files over UPX-, Themida-, or VMProtect-protected inputs; Windows compatibility, including newer builds; special handling for MemoryUSGModular .NET crypter/stub-generation service using a custom “USG” pipeline that combines in-house mutators with enterprise obfuscators to produce unique per-client buildsVIP CryptWhile mrlapis has been active since at least 2011, Insikt Group assesses that they are most notably associated with the development and sale of a crypting service referred to as “VIP Crypt”.VIPCrypt 3.0In June 2023, mrlapis posted the VIPCrypt 3.0 announcement on the underground forum Exploit, advertising a rewritten native crypting service designed to bypass AV products in real-world conditions.VMProtectrequirements and qualifications include a preference for clean, unpacked files over UPX-, Themida-, or VMProtect-protected inputs; Windows compatibility, including newer builds; special handling for Memory Integrity;xKyle CryptThe threat actor has previously mentioned an affiliation with another crypting threat actor who goes by the moniker “KyleTheXyle”, the seller of xKyle Crypt.