Telegram

HeartCrypt is a packer-as-a-service (PaaS) developed in July 2023 and launched in February 2024, designed to help malware operators evade antivirus detection. It has facilitated the packing of over 2,000 malicious payloads across 45 malware families. HeartCrypt injects harmful code into legitimate executable files, complicating detection by antivirus software. It is promoted on underground forums and Telegram channels, charging a fee per file for packing Windows x86 and .NET payloads. Its clients include operators of malware families like LummaStealer, Remcos, and Rhadamanthys. The packing process involves several techniques: - Payload Execution: The payload is encrypted with a single-byte XOR operation and executed through process hollowing or .NET framework capabilities. - Stub Creation: Position-independent code (PIC) is integrated into the binary’s .text section. - Control Flow Hijacking: The entry point of the original binary is altered to redirect execution to the malicious PIC. - Resource Addition: Resources disguised as BMP files contain encoded malicious code. - Obfuscation Techniques: Multiple layers of encoding are used, including stack strings and dynamic API resolution. HeartCrypt employs anti-analysis techniques such as loading non-existent DLLs to detect sandbox environments and using virtual DLLs to evade Windows Defender’s emulator. The service lowers entry barriers for malware operators, potentially increasing malware infections. Security researchers have analyzed HeartCrypt payloads, revealing insights into its operations and associated malware campaigns.