What is Cryptor?

[Hacker]

Cryptor (from the English word "Cryptor" - cryptographer) is the name of one of the types of software products that are used by virus programmers in order to hide the malicious essence of the software they write from antivirus programs.

Cryptor, using encryption of a program containing a virus, masks and protects it from antivirus programs that use signature search methods.

There are two types of cryptors: regular and polymorphic. Regular cryptors have a static decryptor-decryptor signature, while polymorphic cryptors have a dynamic signature, and each time they are compiled, they (files packed with such cryptors) look different.

So how do cryptors work? Everything is quite simple: the original source file of the malicious program is taken, then this program is encrypted with some cryptor, while the code for decrypting the program is written to the beginning of the newly received file. To make it more clear, we will explain with a simple example: a certain Trojan program is taken and archived by the WinRAR archiver, and it is archived not just like that, but with password protection. After performing these actions, no antivirus program will be able to get to this Trojan, since they can't decrypt passwords to archives.

There is one small pitfall here. Antivirus programs add decryption codes for the most common cryptor programs to their signature databases, but if you have created a program that is not a virus at all, but performs only useful actions, but at the same time packed it to reduce the size of any popular cryptor, then it can often happen that the antivirus will start swearing that this program contains a terrible virus when you try to copy this program to your computer or run it.

In general, according to the type of availability, cryptors are divided into Public (Public) and Private (Private).

The first type of cryptor is publicly available, they are widely distributed on the Internet and, if desired, any user can download them. The main negative side of such cryptors is that after a very short period of time, they begin to burn with almost all antiviruses (after all, anti-virus laboratories also do not sleep and try to catch fresh types of cryptors, especially since they are not caught if they are freely available).

With the second view, everything is not so simple. These cryptors are available only to a select community of people, or they can be purchased for very real money (mostly electronic). This type of cryptor is more resistant to anti-virus scanning due to both constantly improving encryption algorithms and a constantly updated stub. What is a stub, you may ask? We'll respond. Stub – the part of the cryptor code that is used to decrypt the malware data that was encrypted by this cryptor.

Often, the abbreviations FUD and semiFUD are used in the sections of forums where cryptors are presented. Let's decipher these abbreviations to make it more clear to you. What is it?

1) FUD - Full Undetected - "completely undetected by antivirus programs»

2) semiFUD - Semi-full undetected - "almost undetectable by antivirus software".

In addition to cryptors, when writing malicious software (viruses and Trojans), some other types of programs are also used. Let's briefly list their names and explain what they serve for.

To steal ICQ numbers, usernames and passwords to email accounts and social networks, special Trojan programs called pinches and xinches are used.

Special php scripts, called gates, are used to receive and process stolen information.

Joiners are used to connect a secure program and a virus to a single file. At the same time, the functionality of both the first (for example, a photo) and the second (for example, a Trojan virus) remains at the highest level.

 

[dunkelh3it]

What is Cryptor trojan?​

Name	Cryptor
Infection Type	Trojan
Symptoms	Executable code extraction; Injection (inter-process); Injection (Process Hollowing); Creates RWX memory; Executed a process and injected code into it, probably while unpacking; Network activity detected but not expressed in API logs; Anomalous binary characteristics;
Similar behavior	Dustylog, Selfmod, Vigorf, Khalesi, Olsa, DxmStrt
Fix Tool	Loaris Trojan Remover See If Your System Has Been Affected by Cryptor trojan

The name of this kind of malware is an allusion to a well-known tale regarding Trojan Horse, that was used by Greeks to get in the city of Troy and win the battle. Like a dummy horse that was made for trojans as a present, Cryptor trojan virus is dispersed like something legit, or, at least, helpful. Malicious apps are concealing inside of the Cryptor trojan virus, like Greeks inside of a big wooden dummy of a horse.1
Trojan viruses are one of the leading malware kinds by its injection frequency for quite a long time. And now, throughout the pandemic, when malware became enormously active, trojan viruses boosted their activity, too. You can see lots of messages on diverse websites, where users are grumbling about the Cryptor trojan virus in their computer systems, as well as asking for help with Cryptor trojan virus elimination.

Trojan Cryptor is a sort of virus that infiltrates right into your system, and after that executes a wide range of destructive functions. These functions depend on a kind of Cryptor trojan: it may work as a downloader for additional malware or as a launcher for another destructive program which is downloaded in addition to the Cryptor trojan. Throughout the last 2 years, trojans are likewise dispersed using e-mail attachments, and in the majority of cases used for phishing or ransomware infiltration.

Cryptor2 also known as​

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.62751
FireEye	Generic.mg.07e30c93b3293e79
CAT-QuickHeal	Trojan.DriveHide.VN8
McAfee	PWS-FCRZ!07E30C93B329
Sangfor	Malware
BitDefender	Gen:Variant.Barys.62751
K7GW	Trojan ( 005732891 )
Cybereason	malicious.3b3293
TrendMicro	TROJ_GEN.R06EC0PKI20
Symantec	Infostealer.Lokibot!43
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Dropper.LokiBot-9792233-0
Kaspersky	UDS DangerousObject.Multi.Generic
Rising	Trojan.Injector!8.C4 (TFE:5:WD6A3HEZXfD)
Ad-Aware	Gen:Variant.Barys.62751
Emsisoft	Gen:Variant.Barys.62751 (B)
Comodo	TrojWare.Win32.Banker.atp@204bg8
F-Secure	Trojan.TR/Kryptik.toyml
DrWeb	BackDoor.SpyBotNET.25
Invincea	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Fareit.bh
SentinelOne	Static AI – Suspicious PE
Avira	TR/Kryptik.toyml
MAX	malware (ai score=83)
Microsoft	Trojan:MSIL/Cryptor
Arcabit	Trojan.Barys.DF51F
ZoneAlarm	UDS DangerousObject.Multi.Generic
GData	Win32.Trojan.PSE.TIIZY5
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Gen.Reputation.C4224494
Acronis	suspicious
VBA32	Malware-Cryptor.Inject.gen
ALYac	Gen:Variant.Barys.62751
Malwarebytes	Trojan.MalPack.DLF
ESET-NOD32	a variant of Win32/Injector.ENXZ
TrendMicro-HouseCall	TROJ_GEN.R06EC0PKI20
Fortinet	W32/GenKryptik.EWDK!tr
BitDefenderTheta	Gen:NN.ZelphiF.34634.VGW@aeA8RNei
AVG	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_60% (D)
Qihoo-360	HEUR/QVM20.1.5BDB.Malware.Gen

What are the symptoms of Cryptor trojan?​

• Executable code extraction;
• Injection (inter-process);
• Injection (Process Hollowing);
• Creates RWX memory;
• Executed a process and injected code into it, probably while unpacking;
• Network activity detected but not expressed in API logs;
• Anomalous binary characteristics;

The usual signs and symptom of the Cryptor trojan virus is a progressive entrance of various malware – adware, browser hijackers, and so on. As a result of the activity of these malicious programs, your computer becomes really lagging: malware absorbs substantial amounts of RAM and CPU capabilities.

An additional noticeable impact of the Cryptor trojan virus existence is unknown programs showed off in task manager. Sometimes, these processes might try to simulate system processes, but you can understand that they are not legit by taking a look at the genesis of these tasks. Quasi system applications and Cryptor trojan’s processes are always specified as a user’s processes, not as a system’s.