Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Examining the Cybercrime Underground, Part 1: Crypters

Summary: Unit 42's first post in its Examining the Cybercrime Underground series describes crypters as tools that combine encryption, obfuscation and code manipulation to make malware fully undetectable to legacy security products, noting a Google search for "fud crypter download" returned 152,000 results. The post traces the DataScrambler crypter, rebranded from LightCore after Unit 42's 419 Evolution paper, and a spear-phishing campaign using a RAR attachment named New Purchase Order.rar whose SFX infector hides an AutoIt crypter that decrypts DarkComet with RC2 in memory and injects it into a signed Chrome process.

Why it matters: A DarkComet sample scores 47/56 on VirusTotal, but once wrapped in this crypter the payload runs inside a Chrome binary signed by Google that scores 0/55, so signature-based detection has nothing left to match on. The crypter seller promises updates within 48 hours of any detection, which sets the refresh rate your defenses are actually racing against.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related