Malware Crypting Services and the Threat Actors Who Sell Them

Executive Summary

Crypting services and products modify malicious payloads to help threat actors bypass detection, complicate analysis, and preserve malware usability after exposure. Although basic crypting consists of encrypting or obfuscating a customer-supplied payload, mature providers increasingly operate as broader malware-enablement services. Their offerings often combine payload wrapping, in-memory execution, anti-analysis checks, process injection, persistence options, delivery packaging, and post-detection “cleaning” or re-crypting services.

Insikt Group analyzed 24 threat actors advertising crypting services and products within the past year and identified a market that is competitive, reputation-driven, and heavily focused on Windows payloads. Providers advertise through underground forums, restricted communities, chat platforms, clearnet sites, and social media accounts. They compete through tiered pricing, antivirus (AV) detection scores of crypted samples, discounts, malware-developer partnerships, private or shared stubs, and promised turnaround times for re-crypting detected payloads.

Advertised crypter capabilities vary by provider, but the underlying objectives are consistent: reduce detection, delay or prevent analysis, and support stealthier payload execution. Because crypted payloads are designed to defeat both static and dynamic analysis, defenders should prioritize behavioral detection over static indicators. See the Outlook and Mitigations section for details.

Key Findings

• AV and endpoint detection and response (EDR) tools should not be treated as sufficient standalone protection against crypted payloads. Defenders should pair endpoint controls with behavioral detection, telemetry correlation, upstream hunting, suspicious process monitoring, and rapid triage of suspicious samples.
• Popular crypting service providers primarily advertise support for Windows payloads, with no identified advertising for macOS or Linux crypting services. However, although Windows environments were most frequently targeted by the services reviewed in this report, they are not inherently more susceptible to the execution of crypted payloads.
• Crypted payloads increase the likelihood of successful malware execution and delayed detection, but they do not independently provide end-to-end intrusion capability. Downstream activities, such as lateral movement, data theft, ransomware deployment, and follow-on compromise, depend on the embedded malware and the operator's objectives.
• Crypter risk varies significantly with provider maturity and technical capability: advanced crypters offer portability, anti-analysis, process injection, persistence, and security product bypass capabilities, whereas less-advanced crypters generally provide basic payload obfuscation techniques.
• Crypter capabilities are generally not novel individually, but their commercial packaging makes established defense-evasion tradecraft easier to access, reuse, and operationalize. The significance of crypters lies less in technical innovation than in making mature evasion methods available as paid services.

The Crypter Landscape

What Is a “Crypter”?

“Crypting” is what threat researchers generally refer to as a service or product wherein a file, almost exclusively a malicious executable of some kind, is encrypted to bypass malware detection technologies. The result of a crypting service is a malicious payload that modifies the supplied executable in ways that deter defenders and endpoint security solutions (namely, AV and EDR products) from detecting and analyzing it.

How Does Crypting Work?

While the core functionality of a crypting service or product is to encrypt a payload, services vary in the capabilities they provide. These capabilities can range from the encryption algorithms used, which are often proprietary, to behavioral adjustments for how the resultant payload will execute in a victim environment. For instance, many crypting services include execution guardrails or methods for indicator suppression, such as ensuring execution fails in virtual environments or performing environmental scanning before execution to determine whether the payload is running in an analysis or sandbox environment.

By using crypting services, threat actors can evade detection and prevent their malicious code from being easily exposed to researchers, an important consideration for those who wish to reuse payloads for extended periods without detection.

Who Is Selling Crypting Services?

The crypter landscape comprises a community of criminal threat actors that often operate on restricted or closed networks, including the dark web and underground forums, to market and sell their crypting services. Threat actors may also opt to market their services on clearnet websites they own and operate. In some instances, threat actors may be accessible only via messaging platforms, such as Telegram or TOX, which likely mask their exposure and reduce the likelihood of sensitive data leaking through forum chats. Finally, some threat actors have created social media accounts where they post updates on their services, partnerships, pricing, and links through which interested buyers can inquire about purchases.

Additionally, partnerships between malware developers and crypting service providers are not uncommon. For instance, a well-established crypting service provider on underground forums, “GoldenCrypt”, is reportedly affiliated (1, 2, 3) with multiple malware families, including FvncBot, Albiriox, and Mirax. The level of affiliation between a crypting service provider and a malware developer can range widely, from providers with loose reputational ties to developers who are mainly affiliated with one hacking group and will opportunistically provide services to third parties. However, these partnerships are often a marketing strategy that crypting service providers use to secure kickbacks and boost positive reputational sentiment.

All of these services come at widely varying costs, typically based on core factors. For instance, crypting service fees are often tied to the volume and types of files to be encrypted, as well as the duration of service, with almost all crypting service providers offering tiered payment options along these lines. The actual prices of these tiers are pegged to additional factors related to the provider and their product, including the reputation of the threat actor, the capabilities of their encryption service, the promise that a crypted payload is fully undetectable (FUD), and additional features provided to the buyer. Threat actors will support the assertion that their payloads are FUD by using multi-AV platforms, the most common of which is KleenScan, a service that allows threat actors to scan samples without storing and potentially exposing the samples to researchers. As with other legitimate services, service providers also advertise discounts and similar deals to remain competitive with their peers.

Who Is Using Crypting Services?

Many threat actors have been observed in the wild using crypting services due to their stealth capabilities. All malware types can be crypted, and the key factors determining whether a threat actor can use a crypting service are the targeted device’s operating system and the payload’s programming language. For instance, the most common crypting services are geared toward Windows .exe and .dll payloads. Still, considerations such as whether a payload is coded in .NET, C, or C++ can provide additional capabilities for crypted payloads or, in other instances, prevent certain payloads from being crypted.

While the use of crypting services is common among threat actors, it is by no means ubiquitous. Due to sometimes prohibitive pricing strategies and an environment that often relies on reputational checks before purchase, crypting services are often used only by well-established criminal threat actors or larger threat actor groups that have their own specialist or custom tooling for crypting payloads. Furthermore, as discussed previously in this report, not all crypting services support all types of payloads. While this does not expressly ensure that a payload cannot be crypted, threat actors seeking to crypt more unique types of executables may find their options limited or even nonexistent.

Nevertheless, crypting services are commonly marketed by threat actors and are commonly implemented by professional threat actor groups. Multiple open-source reports on high-impact cyberattack campaigns have supported this. For instance, in July 2025, eSentire reported an association between PureRAT, a remote access trojan (RAT) first advertised in January 2023, and GhostCrypt, a crypting service sold by an underground forum member of the same moniker, in an attack that impacted a public US accounting firm in May 2025.

Crypting Service Characteristics

Insikt Group investigated 24 crypting service or product providers active within the past year and identified the various capabilities advertised by each. This information helped determine the capabilities most commonly displayed by crypting services, products, and the payloads they create, and provided insight into the capabilities most desirable to customers buying these services and products. A heat map of the techniques advertised by these threat actors is shown in Figure 1, below. (The list of MITRE ATT&CK techniques shown in Figure 1 can also be found in Appendix B.)

Figure 1: MITRE ATT&CK Enterprise tactics and techniques described in crypting advertisements (Source: Recorded Future)

As previously mentioned, crypting services and products modify customer-provided payloads to reduce the likelihood that security tools will detect, analyze, or block them. Crypter providers most often market their services or crypter products as FUD or “bypass” offerings, with frequent references to evading Microsoft Defender, SmartScreen, AV products, and EDR tools. Based on data collected by Insikt Group about crypting advertisements, lower-capability services typically focus on basic file crypting. In contrast, higher-capability services advertise broader loader, delivery, persistence, and anti-analysis functionality.

Portability

Support for multiple payload formats and delivery mechanisms is one of the most commonly advertised capabilities beyond basic payload obfuscation. Providers advertise public, private, and shared stubs (unique wrappers applied to threat actor-supplied payloads generated by the crypting service or product); AES-256 payload encryption; runtime in-memory decryption; GZIP compression; junk code injection; string encryption; and unique polymorphic code per build. These capabilities are intended to make each crypted payload more difficult to identify through static signatures and to slow reverse engineering. Some services also offer repeated “cleaning” or updates to their encryption routines after detection, reflecting an operational model in which the provider continuously modifies the stub or payload wrapper to evade detection.

Many threat actors also advertise support for multiple payloads and delivery formats. Advertisements reviewed by Insikt Group included support for EXE, DLL, DOC, PDF, MSI, LNK, BAT, and APK files. Threat actors also offer multiple ways in which the crypted samples can be packaged and presented to victims, including PDF-based payload packaging, CAPTCHA-themed delivery packaging, mass-mailing campaign packaging, FUD launchers, and direct-link payload delivery, all of which can often be tailored for use in phishing and social engineering operations. These offerings show that crypter services are not limited to Windows executable payloads.

Defense Evasion and Anti-Analysis

Robust anti-analysis and defense evasion capabilities are recurring differentiators among more advanced providers. Advertised capabilities include execution limitations in virtualized, debugging, and sandbox environments. Many crypters also implement the Sleep Windows API function to delay execution, thereby evading detection and hindering analysis across the aforementioned environments. Also, according to the advertisements, crypters often implement additional anti-analysis capabilities, such as Windows Defender and SmartScreen bypasses, AV-kill functionality, protected registry keys, AMSI bypass, Event Tracing for Windows (ETW) patching, syscall unhooking, and direct syscalls. Several providers also advertise process injection methods, including DLL injection, process hollowing, asynchronous procedure call (APC) injection, Common Language Runtime (CLR) injection, reflective .NET assembly loading, and abuse of the .NET Profiling API. These features extend the crypter’s role beyond simple encryption, providing additional anti-analysis and detection support throughout execution.

The most commonly targeted products for evasion techniques are Microsoft security controls, especially Windows Defender and SmartScreen. Other named targets include Kaspersky, ESET, Bitdefender, Norton, Avast, AVG, Malwarebytes, Trend Micro, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender. These claims should be treated as provider-advertised capabilities unless corroborated through sample analysis, detection telemetry, or third-party reporting.

Persistence

Persistence is another feature commonly advertised by crypting providers. Observed advertisements include references to the following artifacts that customers can optionally include when requesting a new crypted build:

• Registry Run keys
• Startup Folder entries
• Scheduled Tasks
• Windows services
• WMI event subscriptions
• Office COM add-ins
• PowerShell profiles
• AppInit DLLs
• Image File Execution Options (IFEO) Debugger entries
• Winlogon Shell modification
• Local Security Authority (LSA) Security Package registration
• Print Monitor DLLs
• Netsh helper DLLs
• Security Support Provider registration
• BITS jobs

Additionally, advertisements included service instantiation options to maintain persistence, such as DLL and COM hijacking. Other providers advertise “advanced startup persistence” without specifying the persistence mechanism.

Prominent Crypting Service Threat Actors

Many threat actors operate within the crypting service landscape, and while the main services they sell all achieve the same goal, the threat actors, their methods, and the results of their services are unique. This section discusses three notable threat actors, including their histories, the services they advertise, and technical details about the products they produce.

To compare the differences between these threat actors and their respective services, Insikt Group analyzed 24 threat actors that actively sold crypting services within the past year, each residing in a separate “tier” of service provider based on the following stipulations:

• Tier 1: Threat actors that have a longstanding history of providing crypting services. These threat actors are well-known and are generally well-regarded as crypting service vendors and as distinct entities within the crypting service landscape.
• Tier 2: Threat actors that have established themselves in the crypting landscape as reliable service providers. While not as well-known as Tier 1 actors, these providers have customer feedback and reviews indicating they are reliable.
• Tier 3: Threat actors that are relatively new to the crypting landscape and, as such, are working to establish themselves in the underground community with little to no feedback or reviews from customers.

Notably, these tiers do not address the veracity of the technical capabilities of these threat actors as displayed in their crypting services. In this landscape, if subpar service is provided, this discovery is often made early and, as a result, threat actors who provide it do not last long in the space. Therefore, all the threat actors discussed in this section (two Tier 1 and one Tier 2 threat actor), as well as the remaining 21 listed in Appendix A, are believed capable of providing technically sound crypting services and products.

Tier 1: mrlapis

Figure 2: Profile and associated information for mrlapis (Source: Recorded Future)

Background

mrlapis is a well-established vendor active across several darkweb and special-access forums. While mrlapis has been active since at least 2011, Insikt Group assesses that they are most notably associated with the development and sale of a crypting service referred to as “VIP Crypt”. On several forums, this threat actor has dedicated long-standing threads advertising their VIP Crypt service. Within these threads, the following points of contact are provided by mrlapis: Telegram (@mrlapis_real), Tox (2912CA4F42B6B37C749D759C43340959D5B9DE74E0242B83A3C5CF27FDADAA1DF83038A66255), and Jabber (mrlapis[@]exploit[.]im). Additionally, based on proprietary methods and sources used by Insikt Group, the following IP address was found to be associated with mrlapis: 46[.]183[.]217[.]105. This IP address is associated with the privacy-focused VPN service Air VPN and has an exit node in Latvia.

At the time of analysis, mrlapis advertised VIP Crypt on a subscription basis for $500 per week, with auto-renewal until canceled. For a first-time purchase, users are instructed to upload the file to be crypted to the temporary file upload service Temp[.]sh. Once the file is uploaded and verified by mrlapis, payment is requested. Upon receipt, the file will be delivered back to the user via Temp[.]sh. After this first-time purchase, users gain access to a secure file transfer protocol (FTPS), at which point the VIP Crypt team will crypt the files per the buyer's specifications. According to mrlapis, the file is re-encrypted every ten minutes. Based on proprietary methods and sources used by Insikt Group, mrlapis uses the following address as an FTPS server: 91[.]92[.]242[.]14[:]9090. When crypting is complete, the buyer is contacted, and the newly crypted files are sent to the buyer via the FTPS server, demonstrating the threat actor’s effort to ensure files are sent securely over an encrypted channel. Insikt Group has also previously observed mrlapis disseminating crypted content via FTPS from 5[.]61[.]36[.]246[:]9090. These addresses are likely two of many additional endpoints from which mrlapis and the VIP Crypt team deliver crypted payloads.

In the dark web and special-access forums services industry, seller longevity is rare and is linked to reputation on these platforms. In addition to the mrlapis’s longevity, the majority of feedback on underground forums is positive, with multiple community members endorsing mrlapis and VIP Crypt. While there is evidence that mrlapis previously had to engage in arbitration — a conflict resolution method that underground forum members will undergo when dissatisfied with a purchase (usually related to false advertising or fraud) within underground forum communities — these events are sparse and appear to have ended favorably for mrlapis, maintaining the theat actor’s reputation.

There is currently no information indicating a direct link between mrlapis or VIP Crypt and any other malware developer; however, mrlapis has published comments over the years discussing the crypting service’s capabilities across multiple malware families, including Rhadamanthys and Remcos RAT. While no concrete link exists, it is clear from the advertisements that VIP Crypt is used with various commodity malware payloads, and that support for crypting these payloads is likely a convenience for mrlapis.

Technical Capabilities

Just as mrlapis has been active since January 2011, Insikt Group assesses that VIP Crypt has been similarly active since this time based on mrlapis’s discussions on underground forums pertaining to the service. Over the years, the crypting service has experienced numerous updates and refinements, including multiple updates to operate effectively across every version of Microsoft Windows and to effectively bypass Windows-native AV solutions. Due to the comparatively large lookback period associated with VIP Crypt operations, Insikt Group gated the analysis of the service to its most recent significant update, version 3.0.

In June 2023, mrlapis posted the VIPCrypt 3.0 announcement on the underground forum Exploit, advertising a rewritten native crypting service designed to bypass AV products in real-world conditions. The operators claimed VIPCrypt 3.0 preserved previous advantages while improving detection avoidance, citing test results in which a Remcos RAT sample dropped from 18 of 25 detections on avcheck[.]net and 11 of 21 detections on scanner[.]to before crypting to 0 of 25 detections on avcheck[.]net and 1 of 21 detections on scanner[.]to after crypting. mrlapis also advertised that VIPCrypt 3.0 bypassed Windows Defender and Chrome Alert; did not use .NET or a dropper; supported payload generation for Windows XP, Windows 7, and later Windows versions; and could provide encrypted files through FTPS with automatic crypting every ten minutes and optional upload to customer-controlled servers.

Since June 2023, mrlapis has continued to advertise VIP Crypt updates focused on Windows Defender evasion, runtime bypasses, automated recryption, and stealthier payload execution. Across 2023 and 2024, mrlapis advertised local Windows Defender detection cleaning for submitted samples that could be retrieved from cloud infrastructure, during Chrome or Edge downloads, and from virtual private servers (VPS) in customer-selected countries. mrlapis also advertised additional updates, including runtime bypasses for AVG, Avast, Emsisoft, and Ikarus; a universal runtime bypass; process hollowing; indirect syscall-based EDR bypass; and support for crypting x64 Windows executables. In terms of user experience and quality-of-life updates, they also continued to advertise FTPS-based auto-crypting, customer-hosted uploads, crypted sample detection monitoring, custom modifications, “pumping,” and ZIP or RAR auto-archiving and unarchiving. Notably, during this time, mrlapis stated that they were unable to crypt APK files, a technical barrier for the developer that likely persists, as no evidence to the contrary has been posted to date.

Throughout 2025 and 2026, mrlapis continued advertising Windows Defender and .NET-focused improvements, including a .NET Windows Defender bypass, a Windows Defender Antimalware Scan Interface bypass for .NET assemblies, and dynamic-key recryption that changes file contents every ten minutes. More recent information from mrlapis alleges that their crypted outputs are still FUD, advertising FUD statuses for avcheck and Windows Defender Cloud, without requiring extended validation (EV) code-signing certificates.

Sample Analysis

Analysis of a recent VIP Crypt sample indicates that the service employs a multi-stage, Delphi-based loader designed to conceal and execute embedded payloads via an in-memory loading process.

The sample combines resource-based storage, segmented data structures containing non-functional padding, staged decoding, in-memory execution, and manual Portable Executable (PE) mapping to

conceal the embedded payload and complicate payload recovery. These techniques increase the difficulty of static analysis and reduce reliance on normal file-backed loading mechanisms that security tools commonly monitor. Execution is ultimately transferred from the decoded loader stage to a manually mapped payload, further obscuring the relationship between the initial executable and the final payload.

The sample is implemented as a Delphi application. During form initialization, the loader retrieves a protected loader stage stored within application resources. The resource data is organized into segmented blocks interspersed with non-functional padding, requiring reconstruction before decoding can occur. After reconstruction and decoding, the recovered loader stage executes in memory and serves as a second-stage loader that carries an embedded PE.

The second-stage loader prepares the embedded PE for execution without relying on the standard Windows image-loading process. Instead, it manually maps the PE into memory by allocating memory for the image, copying headers and sections, resolving imports, applying relocations, and setting memory protections before transferring execution to the payload entry point. As a result, the embedded PE is loaded and executed entirely through memory-resident loader code rather than through a normal file-backed loading sequence.

Tier 2: o1oo1

Figure 3: Profile and associated information for o1oo1 (Source: Recorded Future)

Background

o1oo1 is a seller active on multiple dark web forums. The threat actor has been observed selling the malware encryption tool ASMCrypt and TOP RAT (aka SnappyClient), a commodity RAT first offered in September 2025. o1oo1 has a reputational score of 118, comprising 120 endorsements and two negative ratings, and has ten confirmed transactions.

While o1oo1 maintains a broadly positive forum reputation, the threat actor has also faced disputes related to service fulfillment and customer support. In one dispute, the threat actor “living” stated they paid $6,119 for a one-month subscription to RAT and crypter services and alleged that o1oo1 took three weeks to set up access to these services. o1oo1 disputed the complaint and accused the customer of attempting to manipulate the refund process; the customer ultimately received a 50% refund after removing allegedly false posts from the sales thread. o1oo1 also received allegations of ticket forgery and of removing prices from submitted tickets.

Technical Capabilities

o1oo1 advertises their crypting service, ASMCrypt, for $3,000 per month. Customers who rent TOP RAT for $5,000 per month can rent ASMCrypt for $2,000 per month. o1oo1 advertises ASMCrypt as having customizable anti-virtual machine (anti-VM) functionality that can be configured based on minimum RAM and CPU requirements, banned hypervisors, system names, MAC addresses, and GPU names.

The threat actor also advertises options to allow execution only on systems with common consumer graphics cards from NVIDIA, AMD, or Intel, or to block common VM GPU names by default. o1oo1 further claims that ASMCrypt’s default options prevent execution in VirusTotal analysis environments and that users can also save anti-VM configurations for later use. ASMCrypt is also advertised as offering Windows Defender exclusion functionality that does not rely on PowerShell; instead, it performs elevation and exclusion internally, with spoofing intended to make the exclusion harder for Windows Defender to block. The advertisement also claims that ASMCrypt can exclude the root system drive to effectively disable Windows Defender on the system and that the crypter selects random custom injection targets, which the threat actor frames as improving stealth and stability.

As discussed in the next section, ASMCrypt serves as a builder for HijackLoader (also known as IDAT Loader) packages, which is how it obfuscates payloads. Public reporting indicates that HijackLoader supports capabilities such as API unhooking, direct and indirect syscall execution, stack spoofing, anti-debugging and anti-virtualization checks, security product detection that modifies execution behavior, and multiple configurable process injection techniques. By implementing the HijackLoader builder, ASMCrypt can provide its payloads with defense evasion and anti-analysis capabilities.

Sample Analysis

Analysis of samples crypted with ASMCrypt indicates that the crypter functions as a builder, generating HijackLoader packages. The observed execution chain combines several techniques commonly associated with defense evasion and staged payload delivery, including abuse of legitimate signed applications, DLL sideloading, externally stored encrypted configuration, working directory relocation, staged process creation, and process injection.

The analyzed packages implement a multi-stage loader architecture in which execution is distributed across multiple files, including a legitimate signed host application, a side-loaded DLL, and externally stored encrypted configuration data. This architecture combines signed application abuse, DLL side-loading, and modular configuration data to initiate execution.

Execution begins when the legitimately signed application is launched from the package directory and loads an attacker-controlled DLL through DLL side-loading. Static analysis showed that the side-loaded DLL reads encrypted external package data containing the HijackLoader configuration. The recovered configuration and module structure are consistent with the modular architecture of HijackLoader described in public reporting.

Dynamic analysis showed that the loader packages the components into a working directory under ProgramData, relaunches the signed application from that location, and continues execution from the staged package environment. Subsequent execution progresses through the HijackLoader execution chain before transitioning into later-stage payload execution. Sandbox telemetry observed staged process creation followed by memory injection activity, including remote memory writes and thread-context manipulation, consistent with HijackLoader’s established payload delivery methodology.

Tier 1: ImComplexed

Figure 4: Profile and associated information for ImComplexed (Source: Recorded Future)

Background

ImComplexed is a crypter vendor active on multiple criminal forums, with activity dating as far back as July 2020. The threat actor’s forum presence appears more established than that of new crypter vendors, and publicly available reputation data indicate a positive score of 40 as a seller.

The threat actor has faced disputes related to service fulfillment and customer support. In one forum thread, the buyer requested a refund through the forum's escrow arbitration process, stating that they paid $6,000 for a crypter advertised as 100% FUD and $2,500 for a one-year EV certificate, which was supposed to include full certificate files so they could sign their executables independently. According to the post, after payment, the seller failed to deliver the promised EV certificate files and instead provided an EV certificate that the buyer claims was unusable due to inconsistencies. The complainant also alleges that, rather than delivering the agreed-upon files, the seller insisted on using AnyDesk to access the buyer's VPS, which was not part of the original agreement.

Technical Capabilities

ImComplexed advertises their malware crypter service with limited-time availability and multiple pricing tiers. ImComplexed offers a one-time crypter for $1,000 and several monthly subscription plans, including a $2,500 per month shared plan that allows one shared stub among up to five users with a claimed 24 to 48-hour "cleaning time,” and a $6,000 per month private plan that provides a dedicated stub with a claimed 24-hour “cleaning time.” (“Cleaning time” likely refers to the turnaround time to re-crypt an executable if a customer were to report a detection, and it likely serves as an agreement to prioritize requests for higher-tier customers.) ImComplexed also advertises premium packages priced at $12,000 and $20,000, which include additional features such as multiple simultaneous stubs, a pump feature, customized crypter configuration assistance, faster cleaning times, and, for the highest tier, a claimed User Account Control (UAC) exploit and near-instant cleaning. ImComplexed further notes that pricing for 32-bit and 64-bit crypters is separate, offers a discounted second architecture when purchasing one version, and advertises DLL crypting as an optional paid add-on. Overall, ImComplexed markets a range of crypter services and subscription packages intended to help software evade security detection, with varied pricing based on exclusivity, features, and turnaround time.

In April 2026, ImComplexed advertised a private crypter and claimed it demonstrated evasion of security software. In the same post, ImComplexed promoted a "SPECTRE BOT Runtime Test" conducted with an active control panel and live internet connectivity. The threat actor provided a Streamable video as proof of the test and a KleenScan runtime scan link to demonstrate the results. According to their advertisement, the tested software was able to bypass detection by most AV and endpoint security products, with CrowdStrike identified as the main exception. ImComplexed claims that bypassing CrowdStrike would require additional techniques, such as DLL sideloading or signing the

executable with an EV certificate. The threat actor has also advertised Netwire RAT, claiming to provide video proof of Windows Defender bypass.

Sample Analysis

Analysis of recent ImComplexed samples indicates that the crypter employs a multi-stage loader designed to disguise malicious activity behind a benign-looking Windows application while reconstructing and staging the protected payload in memory.

The analyzed samples present a Hyper-V Manager facade through application metadata, resources, strings, mutex names, and graphical user interface (GUI) initialization routines. During execution, the samples follow a conventional Windows GUI startup path, registering window classes and preparing user interface elements associated with Hyper-V Manager. Before the primary application window is created, however, execution is transferred into a large protected code section that contains the crypter’s loader.

Within the protected section, the loader performs multiple unpacking and reconstruction steps. The protected code uses chunked, obfuscated control flow and PE-aware module and export walking to bootstrap API resolution before preparing the next stage. Encrypted data is decoded in memory before being decompressed into an executable memory region. Rather than producing a standalone PE file at this stage, the decompressed output serves as an executable intermediate stage that continues payload preparation and execution.

The intermediate loader launches a hidden, suspended instance of CMD.exe and stages loader and payload data buffers within the child process. The loader modifies the child thread’s startup context so that execution enters an injected handoff region, which transfers control to child-side loader code. That child-side code decodes and decompresses additional payload bytes before transferring control to the reconstructed payload.

The crypter distributes payload recovery across multiple protected stages rather than exposing a directly recoverable executable. Application masquerading, protected control flow, PE-aware module and export walking, encrypted payload storage, staged decompression, hidden suspended-process creation, thread-context manipulation, and child-side payload decoding all increase analysis complexity and reduce the value of static inspection of the original executable alone.

Outlook and Recommendations

Crypting services are intended to defeat static and dynamic detection by obscuring payload structure, staging execution, and adding defense-evasion capabilities. The services analyzed in this report show that modern crypters increasingly operate as loader frameworks that combine payload encryption, anti-analysis checks, DLL sideloading, in-memory execution, process injection, manual PE mapping, and automated recryption. As a result, defenders should not rely on hashes, static signatures, or AV detections alone to identify crypted malware.

Defenders should prioritize behavior-based detection and response playbooks that focus on how crypted payloads execute rather than on how individual crypted files appear. Although crypting services and products differ in implementation, they share a common objective: separating the initial executable from the final payload while suppressing security teams’ visibility during execution.

Recorded Future customers can hunt for and mitigate the threats associated with crypted malware by:

• Implementing Recorded Future’s Malware Analysis to investigate malicious crypted samples and to hunt for additional context associated with the sample; using artifacts, patterns, and IoCs associated with the activity to surface additional, related samples for continued analysis
• Ingesting data on malware families that implement crypting technologies via Insikt Group reporting, particularly TTP Instances and other note types that focus on malware analysis, where crypting and obfuscation techniques are discussed
• Ingesting data on threat actors that provide crypting services

Detection engineering and threat hunting should prioritize the following behaviors:

• Security product discovery, tampering, exclusion rule creation, or attempted process termination involving AV, EDR, or sandbox-related processes; a list of commonly targeted AV products and their associated process names is provided in Table 1 below
• Suspicious Windows Defender exclusions, especially exclusions affecting root drives, user profiles, temporary directories, download folders, or staging paths
• Execution of unsigned or low-reputation files from %TEMP%, %APPDATA%, %LOCALAPPDATA%, %PROGRAMDATA%, browser download paths, archive extraction directories, or hidden folders
• Legitimate signed applications running from unusual directories and loading non-standard DLLs from the same working directory, consistent with DLL sideloading
• Encrypted or high-entropy external configuration files read by executables or DLLs during early-stage execution
• Relocation of package components into staging directories such as %PROGRAMDATA%, followed by execution from the new location
• In-memory PE loading, manual mapping behavior, executable memory allocation, and execution from memory not backed by a normal on-disk image
• Suspended process creation followed by remote memory writes, thread-context modification, APC queueing, remote thread creation, or other process-injection behavior
• Hidden or unexpected child-process chains, particularly involving cmd.exe, scripting engines, and living-off-the-land binaries (LOLBins) or native Windows utilities
• Persistence mechanisms, including registry Run keys, Startup Folder entries, services, or scheduled tasks pointing to executables in temporary, hidden, or user-writable paths
• Masquerading as legitimate Windows applications through file names, icons, metadata, GUI behavior, mutex names, or window titles
• High-entropy sections, embedded PE artifacts, suspicious resources, or embedded MZ file headers in executables from untrusted sources

Defenders also should pair behavior-based detections with hardening and response measures, including:

• Restricting execution from user-writable, temporary, download, and archive extraction paths through application control or allowlisting
• Enabling endpoint tamper protection and monitoring for attempted security product disabling, exclusion abuse, security process termination, or interference with security tooling
• Treating the following as high-risk: password-protected archives; nested archives; executable attachments; .iso, .vhd, and .vhdx files; shortcut files; and files masquerading as documents
• Isolating affected hosts when suspected crypted malware is identified
• Preserving the initial executable, staged artifacts, relevant memory, and process telemetry where feasible
• Reviewing persistence mechanisms, including registry Run keys, Startup Folder entries, services, and scheduled tasks
• Determining the final payload, command-and-control activity, and any follow-on intrusion activity
• Handling public multi-scanner submissions carefully, as public exposure can alert crypter operators and prompt recryption
• Prioritizing private sandboxing, internal detonation, or trusted intelligence-sharing channels to maintain operational security when analyzing crypted samples

Detection logic should be built around durable loader behavior rather than crypter-specific artifacts. Crypted files can change quickly through recryption, but the behaviors required for payload staging, execution, persistence, and defense evasion are harder to eliminate. The strongest defensive opportunities are therefore not the crypted files themselves, but the execution patterns they must produce to deliver the final payload.

Table 1: Commonly targeted AV products and their associated process names. Each vendor and product is linked to its documentation, which may include additional executables that defenders should consider for monitoring.

Appendix A: Additional Notable Crypting Services

As previously discussed in this report, Insikt Group investigated 24 threat actors in the crypting space. Below is a table of the notable threat actors that Insikt Group investigated (analysis cutoff: May 2026), in addition to those discussed in the section Prominent Crypting Service Threat Actors found earlier in this report.

Appendix B: MITRE ATT&CK

Below is a table that contains the full MITRE ATT&CK Enterprise mappings associated with the behaviors demonstrated across the crypting services that Insikt Group analyzed.