HeartCryptMalware
HeartCrypt is a packer-as-a-service (PaaS) used to protect malware that has been available since at least 2024. HeartCrypt has been used to pack a variety of malware including Lumma Stealer, Remcos, and Rhadamanthys. In the HeartCrypt PaaS model, customers submit malware via private messaging services and it is then packed and returned by the operator as a new binary.From MITRE ATT&CK
Last reported 7 months ago, by ESET WeLiveSecurity (ES)3 reports
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1685Disable or Modify Tools
“Impair Defenses: Disable or Modify Tools”
- T1014Rootkit
“…g Your Own Vulnerable Driver (BYOVD), también vemos a los atacantes abusar con frecuencia de utilidades legítimas de anti‑rootkit o utilizar enfoques driverless para bloquear la comunicación del software de endpoint detection and response (EDR) o suspenderlo…”
- T1027Obfuscated Files or Information
“T1027”
- T1027.002Software Packing
“T1027.002”
- T1027.005Indicator Removal from Tools
“T1027.005”
- T1027.009Embedded Payloads
“T1027.009”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
EDR killers explicados: Más allá de los drivers“Al combinarse con su componente loader empaquetado con HeartCrypt, al que los investigadores de ESET denominaron AbyssKiller, este EDR killer se ha convertido en uno de los más observados comercialmente in the wild.”
-
EDR killers explained: Beyond the drivers“Packers such as VX Crypt (as used with CardSpaceKiller) and HeartCrypt (as used with AbyssKiller) provide structure-level obfuscation, anti‑VM behavior, and continuous repacking to evade static signatures.”
-
Shedding light on the ABYSSWORKER driver“Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation, December 13, 2024.”
Indicators in its reports
named in the reports above- 82ed942a52cdcf12…ba37619661a3in 2 reports
- 54547180a99474b0…8f3eea78b531in 2 reports
- 75f85caea52fe5a1…bd3161690addin 2 reports
- 002573d80091f7f8…2b85fa915f19in 2 reports
- 1e7567c0d525ad03…f40541994411in 2 reports
- 65c2388b0afb1d1f…d8d6cd8b5645in 2 reports
- a9f37104d2d89051…bff44d147e67in 2 reports
- 083f604377d74c43…e34ad7daceeain 2 reports
- 570161a420992280…800296b72d1cin 2 reports
- bbe0e14bc7ece8a7…0476cfcef110in 2 reports
- 31ce76931ca09d39…3bc72e6d647ein 2 reports
- b9820bf443c37557…e3a569a1b9e8in 2 reports
- 34270b07538b7357…8f234b602f93in 2 reports
- 09735640d6634b03…bc80f932126cin 2 reports
- 85bc0a4f67522d6a…5a2945ec5028in 2 reports
- 711c95fead2215e9…0d71ad5c5aa5in 2 reports
- bc65ed919988c8e4…45456601700ain 2 reports
- 148c0cde4f2ef807…0f4c519f47efin 2 reports
- 468121e7d6952799…937c4c5f92edin 2 reports
- c881f43c7fe94a6f…32fe56d8dd9cin 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.