#CRYPTER JAVA HOW TO#

The file is a VBS script which it is 929K and it has a variable named 'pillow' which it is the payload. This sample was detected only by a few AV when it was analysed three days ago: This application checks for a valid licenseĪs mentioned before Fudcrypt is still active as a service and some actors are using it so I'm going to analyse how it works with a recent sampleĮf9c50fd15493937d5ee3366a58e41cd3ca1d9fb386fe578aea700c8f54f0f1a.

In order to use the service and to obfuscated the payload, the author provides a windows application. The author of this malware claims that he is able to install Java JRE in victims which do not have Java installed so the JAR payload can be executed.Īlthough the main website fudcryptcom is not anymore active, the service can still be bought via some underground forums.

#CRYPTER JAVA HOW TO#

The are even some youtube videos on how to encrypt files with this crypt service. This service is announced in several underground forums as 'fully undetected crypt' service and used to have a website where it could be bought for a few dollars. It turned out that this campaign used some crypt service named fudcrypt. In this blog I wrote about a couple of services, qthelegend and qrypter, that obfuscate Java RATs like Adwind.Ī few weeks back there was an interesting campaign against some financial institutions using some Java RAT and some VBS scripts. The existence of services to encrypt and obfuscate malware in order to avoid antivirus detection is nothing new at all.

Crypter java