Search For Content

Search Result

2 item(s) found so far for this keyword.

Runtime Function Decryption

Antivirus/EDR Evasion

This technique is used to store the function body in an encrypted form. They will only be decrypted just before the execution of that code and will be re-encrypted after the code has been executed.

This technique is used by SmokeLoader to evade anti-virus and EDRs, since the function body is in encrypted form except at the time of …

A packing software called CryptOne became popular among some major threat actors. It was first reported by Fox-IT that the group behind Wastedlocker has begun using it, as well as Netwalker, Gozi ISFB v3, ZLoader, Emotet, Dridex, and Smokeloader.

Search For Content

Search Result

Runtime Function Decryption

Antivirus/EDR Evasion

CryptOne

Packers