EasyCrypter

Created the Friday 05 January 2024. Updated 10 months, 1 week ago.

EasyCrypter is the crypter that is being sold via an automated bot on Telegram. The crypter uses a method known as "mutation", which involves replacing instructions in the file with their analogues or a sequence of instructions that yield the same outcome as the original code. EasyCrypter supports a maximum file size of 5MB and is only applicable for x86 .NET/Native files.

Technique Identifier

U1431

Technique Tags

packers easycrypter

Detection Rules

rule EasyCrypter {
    meta:
        author = "RussianPanda"
        description = "Detects EasyCrypter"
        date = "01/05/2024"
        hash = "60063c99fda3b6c5c839ec1c310b03e8f9c7c8823f2eb7bf75e22c6d738ffa8f"

    strings:
        $s1 = {F6 17 [16-20] 80 2F 36 [16-20] 80 07 87}
        $s2 = {81 38 50 45 00 00 [20-22] 8B 88 A0 00 00 00 [2-4] 8B 80 A4 00 00 00 [5-7] 8B 40 50 [50-56] 89 0C 24 89 44 24 04 C7 44 24 08 00 30 00 00 C7 44 24 0C 04 00 00 00 FF 15 [3] 00}

    condition: 
        uint16(0) == 0x5A4D
        and $s1 and $s2 
}

Contributor

RussianPanda

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

https://teletype.in/@dinerosell/EasyCrypterFAQ_RU