Verschlüsselte Herzen: Offenlegung des HeartCrypt Packer-as-a-Service-Betriebs

Teilen:
Category Einzelheiten
Threat Actors Unknown actors offering the HeartCrypt PaaS targeting various regions and industries.
Campaign Overview HeartCrypt is a Packer-as-a-Service (PaaS) launched in February 2024, used to protect malware by obfuscating code within legitimate binaries. Advertised in underground forums and Telegram, it supports 32-bit Windows payloads for $20 per file.
Target Regions (Victims) Observed campaigns in Latin America and other global regions. Specific targets include industries and individuals.
Methodology HeartCrypt injects malicious code into legitimate executables. Techniques include:
➡ Control flow hijacking
➡ Obfuscation (stack strings, junk bytes, etc.)
➡ Anti-sandboxing methods (loop emulation and Windows Defender evasion)
Product Targeted Windows systems, particularly 32-bit binaries.
Malware Reference Associated with LummaStealer, Remcos RAT, XWorm, Quasar RAT, RedLine Stealer, and others.
Tools Used ➡ Telegram
➡ Underground forums (e.g., XSS.is, Exploit.in, BlackHatForums)
➡ API abuse (e.g., LoadResource, VirtualProtect)
Vulnerabilities Exploited Anti-sandbox evasion techniques targeting:
➡ Windows Defender’s VDLL
➡ VM detection with d3d9 library
➡ Dependency emulation checks
TTPs ➡ Packer services for malware
➡ Use of legitimate binaries for obfuscation
➡ Extensive use of control flow obfuscation (jmp instructions, PIC)
➡ Dynamic API resolution
➡ Tailored payload injection into binaries
Attribution Development observed since July 2023 by unknown operators, possibly cybercriminal syndicates.
Recommendations ➡ Implement robust sandboxing to detect obfuscated code
➡ Monitor suspicious use of LoadResource and other API calls
➡ Enhance behavioral analysis to detect unusual control flow manipulations
➡ Educate users about risks of downloading executables from unverified sources
Quelle  Palo Alto Networks (Unit 42)

Read full article: https://unit42.paloaltonetworks.com/packer-as-a-service-heartcrypt-malware/

The above summary has been generated by an AI language model

Quelle

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
5:18 am, Apr. 26, 2025
Wetter-Symbol 8°C
L: 7° | H: 9°
aufgelockerte Bewölkung
Luftfeuchtigkeit: 87 %
Druck: 1021 mb
Wind: 6 mph ENE
Windböe: 0 mph
UV-Index: 0
Niederschlag: 0 mm
Wolken: 40%
Regen Chance: 0%
Sichtbarkeit: 10 km
Sonnenaufgang: 5:41 am
Sonnenuntergang: 8:14 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 10:00 pm
Wetter-Symbol
7° | 9°°C 0 mm 0% 8 mph 86 % 1025 mb 0 mm/h
Tomorrow 10:00 pm
Wetter-Symbol
9° | 21°°C 0.2 mm 20% 4 mph 75 % 1026 mb 0 mm/h
Mo. Apr. 28 10:00 pm
Wetter-Symbol
12° | 21°°C 0 mm 0% 8 mph 86 % 1026 mb 0 mm/h
Di. Apr. 29 10:00 pm
Wetter-Symbol
11° | 20°°C 0 mm 0% 9 mph 61 % 1026 mb 0 mm/h
Mi. Apr. 30 10:00 pm
Wetter-Symbol
11° | 23°°C 0 mm 0% 8 mph 75 % 1025 mb 0 mm/h
Today 7:00 am
Wetter-Symbol
8° | 9°°C 0 mm 0% 4 mph 86 % 1021 mb 0 mm/h
Today 10:00 am
Wetter-Symbol
11° | 13°°C 0 mm 0% 6 mph 77 % 1022 mb 0 mm/h
Today 1:00 pm
Wetter-Symbol
16° | 16°°C 0 mm 0% 8 mph 56 % 1023 mb 0 mm/h
Today 4:00 pm
Wetter-Symbol
16° | 16°°C 0 mm 0% 7 mph 54 % 1023 mb 0 mm/h
Today 7:00 pm
Wetter-Symbol
14° | 14°°C 0 mm 0% 7 mph 60 % 1023 mb 0 mm/h
Today 10:00 pm
Wetter-Symbol
11° | 11°°C 0 mm 0% 3 mph 69 % 1025 mb 0 mm/h
Tomorrow 1:00 am
Wetter-Symbol
10° | 10°°C 0 mm 0% 2 mph 74 % 1025 mb 0 mm/h
Tomorrow 4:00 am
Wetter-Symbol
9° | 9°°C 0 mm 0% 3 mph 75 % 1025 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€83,150.45
1.46%
Ethereum(ETH)
€1,577.14
1.96%
Fesseln(USDT)
€0.88
0.02%
XRP(XRP)
€1.93
0.35%
Solana(SOL)
€132.84
-0.41%
USDC(USDC)
€0.88
0.00%
Dogecoin(DOGE)
€0.164219
3.40%
Shiba Inu(SHIB)
€0.000013
5.21%
Pepe(PEPE)
€0.000009
9.26%
Nach oben scrollen