Malicious Actors Are Extensively Using CypherIT to Package Their Malware

guest · Dec 14, 2019

Malicious Actors Are Extensively Using CypherIT to Package Their Malware
December 13, 2019
https://www.technadu.com/malicious-actors-extensively-using-cypherit-package-malware/87460/

As reported by Check Point Research, malicious actors are using a service called “CypherIT” to wrap their malware samples and benefit from high levels of obfuscation.
According to the firm’s telemetry data, about 13% of all malware executables that were sent via email between August and October 2019 were packed with the CypherIT crypter.

The particular tool is a perfectly legal piece of software that is meant to be used by developers who want to protect their binary files from being reverse-engineered. However, crooks love it too, as it helps them encrypt their malicious executables and avoid AV detection.
CypherIT is not only providing encryption, but also persistence, anti-sandboxing, and UAC bypassing. As it is shown in the following screenshot, the actor may comfortably select what they need via a friendly user interface and have the wrapped file ready within a couple of seconds.

At a cost of $33 per month, this tool is becoming a must-use for malicious actors, as it is increasing their level of success exponentially.
The most annoying thing for security engineers is that CypherIT is rotating its encryption methodology every now and then, which helps to make the obfuscation stronger and the detection harder.
Click to expand...

Check Point Research: DeCypherIT – All eggs in one basket

Log in or Sign up

Malicious Actors Are Extensively Using CypherIT to Package Their Malware

guest Guest

Log in or Sign up

Malicious Actors Are Extensively Using CypherIT to Package Their Malware

guest Guest

Useful Searches