ScrubCrypt
Created the Sunday 19 March 2023. Updated 10 months, 1 week ago.
ScrubCrypt is a malware obfuscation and encryption framework, derived from the earlier JLaive Batchfuscator crypter. It is designed to aid cybercriminals in evading detection and analysis by using a variety of techniques to conceal and protect the malicious software.
ScrubCrypt is advertised on cybercrime forums to employ encryption, code morphing, and (allegedly) polymorphism to create obfuscated malware payloads that are challenging to reverse-engineer and detection.
The Batch files generated by ScrubCrypt contain a Base64 encoded, AES-128-CBC encrypted and gzip compressed payload, which is executed / reflectively loaded.
Technique Identifier
Technique Tags
Detection Rules
Contributors
Additional Resources
External Links
The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.
- https://perception-point.io/blog/the-rebranded-crypter-scrubcrypt/
- ScrubCrypt - The Rebirth of Jlaive - Toxin Labs
- Old Cyber Gang Uses New Crypter – ScrubCrypt | FortiGuard Labs
- https://twitter.com/SI_FalconTeam/status/1742527508682072179