HeartCrypt
HeartCrypt is a malware packer-as-a-service (PaaS) / crypter used by multiple financially motivated threat actors to obfuscate and deliver malicious Windows payloads. Researchers reported it on underground forums in February and March 2024, assessed development began in July 2023, and observed it launch around February 17, 2024. During its first eight months of operation it was used to pack more than 2,000 malicious payloads spanning roughly 45 malware families. It has been advertised on Telegram, BlackHatForums, XSS.is, and Exploit.in, with ads stating support for 32-bit Windows payloads at $20 per crypt.
Technically, HeartCrypt modifies legitimate carrier executables and DLLs by injecting obfuscated position-independent loader code into the .text section, hijacking execution flow near the entry point, and embedding encrypted payloads as PE resources disguised as BMP files. Researchers identified more than 300 distinct legitimate carrier binaries used by the service. The loader uses heavy obfuscation including stack strings, dynamic API resolution, direct jumps, non-returning functions, no-op arithmetic, and junk bytes. Anti-analysis and anti-emulation features include attempts to load fake DLL names such as k7rn7l32.dll and ntd3ll.dll, large calculation loops to detect emulation, and checks for Windows Defender emulator-related APIs such as MpReportEvent and MpAddToScanQueue. The final payload is stored as a single-byte XOR-encrypted Windows executable; HeartCrypt determines whether it is a .NET assembly or native PE and then uses process hollowing or injection into csc.exe, AppLaunch.exe, or a copy of itself. An optional persistence component copies an inflated, null-byte-padded version of itself to disk and establishes persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run or rundll32 execution.
HeartCrypt has been distributed through varied infection chains, especially phishing-driven delivery. Observed methods include password-protected ZIP archives delivered via phishing emails, Google Drive and Dropbox-hosted archives, DLL sideloading, LNK files launching PowerShell, batch-script downloaders, and standalone malicious executables. Campaigns impersonated more than 200 software vendors and targeted countries in every hemisphere, with notable reporting on activity affecting Colombia, Italy, and Latin America more broadly.
Observed payloads commonly include commodity stealers and RATs such as Lumma Stealer, AsyncRAT, Rhadamanthys, Remcos, and XWorm. HeartCrypt has also been used to pack AV/EDR-killer tooling and loaders associated with ransomware operations. Reporting links HeartCrypt-packed components to ransomware intrusions involving RansomHub, BlackSuit, Medusa, Qilin, DragonForce, Crytox, Lynx, INC, Akira, and MedusaLocker. It has been used to obfuscate commercial EDR killers including AbyssKiller and loaders associated with the ABYSSWORKER driver, as well as newer EDR-killer variants that terminate products from vendors including Sophos, Microsoft, SentinelOne, Symantec, Trend Micro, Kaspersky, McAfee, F-Secure, HitmanPro, Webroot, Bitdefender, Cylance, ESET, and Fortinet.
High-confidence indicators and artifacts directly mentioned in reporting include fake DLL names k7rn7l32.dll and ntd3ll.dll used for anti-emulation; persistence paths such as C:\Users{user}\OneDrive\Documents\AvivaUpdate_0001.dll, %USERHOME%\Videos\Cylance\Bin, and \Pictures\HomeDeporte\Bin\HomeDeporte.exe; a March 25, 2024 sample path C:\Windows\Dv0y70b8ALMzQX.exe; and a HeartCrypt-packed ZIP containing HideMouse.exe and 8776_6713.exe in a later intrusion. Overall, HeartCrypt is best characterized as a shared criminal packing and delivery service rather than malware attributable to a single actor.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In many cases, packer-as-a-service offerings such as HeartCrypt are used to obfuscate the tools.
We ultimately concluded that these cases were all connected to what has come to be known as the HeartCrypt packer-as-a-service (PaaS) operation.
Its tooling also involves crypters such as HeartCrypt, PureCrypter, and those developed by threat actors like “Roda” and “pjoao1578”...
Its tooling also involves crypters such as HeartCrypt, PureCrypter, and those developed by threat actors like “Roda” and “pjoao1578”...
Techniques & procedures
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
The process trace indicates that the initial infection could be related to the zero-day RCE exploits... which affected ConnectWise and BeyondTrust products.
This infection chain starts with a phishing email... This email claims to be from an Italian lawyer contacting the recipient about alleged copyright infringement... The malicious content was hosted on a Google Drive in a password-protected ZIP archive; the password was included in the phishing email.
Execution
3 techniques
Execution
This PowerShell command downloads and executes another PowerShell script... This script downloads two further files.
To modify the registry, HeartCrypt uses either Windows API functions or the reg add command via cmd.exe.
Secondly, HeartCrypt hijacks the control flow within the original binary. This is most often achieved by altering the start() function, the entry point for many executables. The modification typically involves adding a call or jmp instruction which redirects execution to the newly added PIC.
Persistence
4 techniques
Persistence
To modify the registry, HeartCrypt uses either Windows API functions or the reg add command via cmd.exe.
the code uses API functions such as CreateProcessW... to load and execute the final payload.
Privilege Escalation
6 techniques
Privilege Escalation
the code uses API functions such as CreateProcessW, VirtualAlloc, GetThreadContext, NtCreateThreadEx, and CreateRemoteThread to load and execute the final payload.
While process hollowing is the primary method of injection, we have identified a sample that references NtQueueApcThread, suggesting that the developer has invested effort into diversifying the injection methods.
If the packed sample is .NET, HeartCrypt will attempt to launch csc.exe (or in some cases AppLaunch.exe) from the Microsoft .NET Framework directory. It then performs process hollowing on the spawned process, injecting and executing the final payload within it. If the sample is not a .NET assembly, HeartCrypt spawns a copy of itself and injects the final payload using a similar process hollowing technique.
the code uses API functions such as CreateProcessW... to load and execute the final payload.
Stealth
15 techniques
Stealth
The injected PIC leverages multiple control flow obfuscation methods to hinder analysis. These include: Stack strings Dynamic API resolution Hundreds of direct jmp instructions Non-returning functions Arithmetic operations that have no effect on program execution Junk bytes after jmp and call instructions, impeding disassembly and decompilation
HeartCrypt was originally discovered through underground forums... it has been used to pack over 2,000 malicious payloads... The packed payload was consistently added as a resource to a legitimate binary... Each resource embedded in the binary contains PIC disguised as a bitmap (BMP) image file. This begins with a standard BMP header followed by a repeating hexadecimal pattern for padding.
The injected PIC leverages multiple control flow obfuscation methods to hinder analysis. These include: Stack strings Dynamic API resolution...
Encrypted malicious payloads inserted as an additional resource... It also inserts a few additional Portable Executable (PE) resources. These resources are disguised as bitmap files and start with a BMP header, but afterwards the malicious content follows.
Malware impersonating, subverting, and embedding itself in legitimate software applications... The HeartCrypt packer takes legitimate executables and modifies them by injecting malicious code in the .text section.
the code uses API functions such as CreateProcessW, VirtualAlloc, GetThreadContext, NtCreateThreadEx, and CreateRemoteThread to load and execute the final payload.
While process hollowing is the primary method of injection, we have identified a sample that references NtQueueApcThread, suggesting that the developer has invested effort into diversifying the injection methods.
If the packed sample is .NET, HeartCrypt will attempt to launch csc.exe (or in some cases AppLaunch.exe) from the Microsoft .NET Framework directory. It then performs process hollowing on the spawned process, injecting and executing the final payload within it. If the sample is not a .NET assembly, HeartCrypt spawns a copy of itself and injects the final payload using a similar process hollowing technique.
When it finds it, it loads the driver and terminates the processes and services from the target list... It also attempts to kill processes such as MsMpEng.exe, SophosHealth.exe, SAVService.exe, and sophosui.exe.
The fourth resource decrypts and injects the final payload... The payload is a Windows executable binary encoded via a single-byte XOR operation rotating over a key hard-coded in the resource PIC as a stack string. After decryption, the PIC parses the decoded PE header...
the DLL file as a standalone component... is copied to C:\Users\{user}\OneDrive\Documents\AvivaUpdate_0001.dll... and registered for startup with the following command line: rundll32.exe C:\Users\{user}\OneDrive\Documents\AvivaUpdate_0001.dll,EntryPoint
Resource 1: Anti-Dependency Emulation... attempts to load non-existent DLLs via LoadLibraryW... If the sandbox responds by generating a dummy DLL... HeartCrypt will call ExitProcess... Resource 2: Sandbox Loop Emulation Check... If this flag is not set, the process will call ExitProcess. Resource 3: Windows Defender Evasion... If HeartCrypt can load this API from kernel32, it can assume the sample is running within the Defender emulator.
Secondly, HeartCrypt hijacks the control flow within the original binary. This is most often achieved by altering the start() function, the entry point for many executables. The modification typically involves adding a call or jmp instruction which redirects execution to the newly added PIC.
Here we see a DynamicShellcode alert... The process trace revealed that the malicious killer was executed from the JWrapper-Remote Access component of SimpleHelp
The resource enters a while loop that performs a large number of mathematical calculations on an initial hard-coded value... The resulting hash is checked against an expected value. If the two values match, the sample will set a flag value within memory to indicate the loop was not emulated or modified in any way. If this flag is not set, the process will call ExitProcess.
Defense Impairment
1 technique
Defense Impairment
Discovery
3 techniques
Discovery
It then proceeds to create a run key in the \SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry location.
Resource 1: Anti-Dependency Emulation... attempts to load non-existent DLLs via LoadLibraryW... If the sandbox responds by generating a dummy DLL... HeartCrypt will call ExitProcess... Resource 2: Sandbox Loop Emulation Check... If this flag is not set, the process will call ExitProcess. Resource 3: Windows Defender Evasion... If HeartCrypt can load this API from kernel32, it can assume the sample is running within the Defender emulator.
The resource enters a while loop that performs a large number of mathematical calculations on an initial hard-coded value... The resulting hash is checked against an expected value. If the two values match, the sample will set a flag value within memory to indicate the loop was not emulated or modified in any way. If this flag is not set, the process will call ExitProcess.
Collection
1 technique
Collection
Command and Control
2 techniques
Command and Control
Other
2 techniques
Other
In today’s multi-stage attacks, neutralizing endpoint security solutions is a critical step in the process, allowing threat actors to operate undetected. Since 2022, we’ve seen an increase in the sophistication of malware designed to disable EDR systems on an infected system.
IOCs tracked for this family
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A packer-as-a-service tool used to pack payloads and inject malicious code into legitimate binaries during malware development/compilation.
Packer used to protect the loader component of AbyssKiller, adding obfuscation and anti-analysis capabilities.
Packer-as-a-service malware used to deliver stealers, RATs, and AVKiller, distributed via phishing emails and LNK files.
A previously popular packer-as-a-service offering used by ransomware groups.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.