Loading malware…
HeartCrypt is a Windows-focused packer-as-a-service and crypter operation used to obfuscate and deliver a wide range of commodity and criminal malware, including stealers, remote access trojans, loaders, and AV/EDR-killer tooling. Development appears to have begun in 2023, with public underground promotion emerging in early 2024. During its first months of operation it was used to protect thousands of malicious payloads spanning dozens of malware families, indicating broad adoption by multiple unrelated threat actors rather than exclusive use by a single group.
Technically, HeartCrypt modifies legitimate carrier executables or DLLs by injecting position-independent loader code into the program body, hijacking execution flow, and embedding encrypted payload components in PE resources commonly disguised as bitmap data. Its loader employs heavy obfuscation, dynamic API resolution, junk instructions, and anti-analysis checks, including anti-emulation and sandbox-detection logic. It decrypts an embedded final payload and launches it through process hollowing, including injection into legitimate Windows processes such as compiler- or application-launcher-related processes for .NET payloads. Some variants also establish persistence by copying an inflated version of themselves to disk and configuring autorun execution.
HeartCrypt has been observed in phishing-driven intrusion chains, including campaigns using password-protected archives, DLL sideloading, shortcut-based downloaders, and cloud-hosted lure content. It has delivered malware such as Lumma Stealer, AsyncRAT, Rhadamanthys, Remcos, and XWorm, and has also been used in ransomware ecosystems to conceal loaders and commercial or proprietary security-disabling tools. Reporting links HeartCrypt-packed components to intrusions involving ransomware groups and affiliates associated with Medusa, Akira, RansomHub, BlackSuit, Qilin, DragonForce, Crytox, Lynx, INC, and MedusaLocker, among others. It has also been used by APT-C-36/Blind Eagle in campaigns targeting Latin America, especially Colombia.
HeartCrypt’s role is primarily defense evasion and payload delivery rather than acting as the final objective malware itself. Its widespread use across financially motivated campaigns, stealer operations, RAT deployments, and ransomware pre-encryption stages makes it a notable commercial enabler within the cybercrime ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.
In many cases, packer-as-a-service offerings such as HeartCrypt are used to obfuscate the tools.
We ultimately concluded that these cases were all connected to what has come to be known as the HeartCrypt packer-as-a-service (PaaS) operation.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
The process trace indicates that the initial infection could be related to the zero-day RCE exploits... which affected ConnectWise and BeyondTrust products.
This infection chain starts with a phishing email... This email claims to be from an Italian lawyer contacting the recipient about alleged copyright infringement... The malicious content was hosted on a Google Drive in a password-protected ZIP archive; the password was included in the phishing email.
This PowerShell command downloads and executes another PowerShell script... This script downloads two further files.
To modify the registry, HeartCrypt uses either Windows API functions or the reg add command via cmd.exe.
Secondly, HeartCrypt hijacks the control flow within the original binary. This is most often achieved by altering the start() function, the entry point for many executables. The modification typically involves adding a call or jmp instruction which redirects execution to the newly added PIC.
To modify the registry, HeartCrypt uses either Windows API functions or the reg add command via cmd.exe.
the code uses API functions such as CreateProcessW... to load and execute the final payload.
the code uses API functions such as CreateProcessW, VirtualAlloc, GetThreadContext, NtCreateThreadEx, and CreateRemoteThread to load and execute the final payload.
While process hollowing is the primary method of injection, we have identified a sample that references NtQueueApcThread, suggesting that the developer has invested effort into diversifying the injection methods.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
the code uses API functions such as CreateProcessW... to load and execute the final payload.
The injected PIC leverages multiple control flow obfuscation methods to hinder analysis. These include: Stack strings Dynamic API resolution Hundreds of direct jmp instructions Non-returning functions Arithmetic operations that have no effect on program execution Junk bytes after jmp and call instructions, impeding disassembly and decompilation
HeartCrypt was originally discovered through underground forums... it has been used to pack over 2,000 malicious payloads... The packed payload was consistently added as a resource to a legitimate binary... Each resource embedded in the binary contains PIC disguised as a bitmap (BMP) image file. This begins with a standard BMP header followed by a repeating hexadecimal pattern for padding.
The injected PIC leverages multiple control flow obfuscation methods to hinder analysis. These include: Stack strings Dynamic API resolution...
Encrypted malicious payloads inserted as an additional resource... It also inserts a few additional Portable Executable (PE) resources. These resources are disguised as bitmap files and start with a BMP header, but afterwards the malicious content follows.
Malware impersonating, subverting, and embedding itself in legitimate software applications... The HeartCrypt packer takes legitimate executables and modifies them by injecting malicious code in the .text section.
the code uses API functions such as CreateProcessW, VirtualAlloc, GetThreadContext, NtCreateThreadEx, and CreateRemoteThread to load and execute the final payload.
While process hollowing is the primary method of injection, we have identified a sample that references NtQueueApcThread, suggesting that the developer has invested effort into diversifying the injection methods.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
When it finds it, it loads the driver and terminates the processes and services from the target list... It also attempts to kill processes such as MsMpEng.exe, SophosHealth.exe, SAVService.exe, and sophosui.exe.
The fourth resource decrypts and injects the final payload... The payload is a Windows executable binary encoded via a single-byte XOR operation rotating over a key hard-coded in the resource PIC as a stack string. After decryption, the PIC parses the decoded PE header...
the DLL file as a standalone component... is copied to C:\Users\{user}\OneDrive\Documents\AvivaUpdate_0001.dll... and registered for startup with the following command line: rundll32.exe C:\Users\{user}\OneDrive\Documents\AvivaUpdate_0001.dll,EntryPoint
Resource 1: Anti-Dependency Emulation... attempts to load non-existent DLLs via LoadLibraryW... If the sandbox responds by generating a dummy DLL... HeartCrypt will call ExitProcess... Resource 2: Sandbox Loop Emulation Check... If this flag is not set, the process will call ExitProcess. Resource 3: Windows Defender Evasion... If HeartCrypt can load this API from kernel32, it can assume the sample is running within the Defender emulator.
Secondly, HeartCrypt hijacks the control flow within the original binary. This is most often achieved by altering the start() function, the entry point for many executables. The modification typically involves adding a call or jmp instruction which redirects execution to the newly added PIC.
Here we see a DynamicShellcode alert... The process trace revealed that the malicious killer was executed from the JWrapper-Remote Access component of SimpleHelp
The resource enters a while loop that performs a large number of mathematical calculations on an initial hard-coded value... The resulting hash is checked against an expected value. If the two values match, the sample will set a flag value within memory to indicate the loop was not emulated or modified in any way. If this flag is not set, the process will call ExitProcess.
It then proceeds to create a run key in the \SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry location.
Resource 1: Anti-Dependency Emulation... attempts to load non-existent DLLs via LoadLibraryW... If the sandbox responds by generating a dummy DLL... HeartCrypt will call ExitProcess... Resource 2: Sandbox Loop Emulation Check... If this flag is not set, the process will call ExitProcess. Resource 3: Windows Defender Evasion... If HeartCrypt can load this API from kernel32, it can assume the sample is running within the Defender emulator.
The resource enters a while loop that performs a large number of mathematical calculations on an initial hard-coded value... The resulting hash is checked against an expected value. If the two values match, the sample will set a flag value within memory to indicate the loop was not emulated or modified in any way. If this flag is not set, the process will call ExitProcess.
In today’s multi-stage attacks, neutralizing endpoint security solutions is a critical step in the process, allowing threat actors to operate undetected. Since 2022, we’ve seen an increase in the sophistication of malware designed to disable EDR systems on an infected system.
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A packer-as-a-service tool used to pack payloads and inject malicious code into legitimate binaries during malware development/compilation.
Packer used to protect the loader component of AbyssKiller, adding obfuscation and anti-analysis capabilities.
Packer-as-a-service malware used to deliver stealers, RATs, and AVKiller, distributed via phishing emails and LNK files.
A previously popular packer-as-a-service offering used by ransomware groups.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.