Loading malware…
HCrypt is a Windows malware crypter and multistage loader used to protect, stage, and inject other malware, especially remote access trojans. It has been described as a crypter-as-a-service offering and has been observed in campaigns since at least 2021 delivering payloads such as AsyncRAT, BitRAT, NjRat, NanoCore RAT, QuasarRAT, LimeRAT, Warzone RAT, RevengeRAT, and Remcos-like final-stage implants. HCrypt commonly operates through heavily obfuscated script chains involving HTA, VBScript, JavaScript, PowerShell, and sometimes AutoHotKey components, with later stages decoding embedded binaries in memory and reflectively loading .NET modules or injectors.
A recurring HCrypt tradecraft pattern is multistage in-memory execution followed by process injection into legitimate Windows or .NET binaries, including use of aspnet_compiler.exe and other trusted processes as hosts for the final payload. Observed chains establish persistence through Startup-folder manipulation, scheduled tasks, or dropped script launchers, then retrieve or reconstruct additional stages, decode embedded PE payloads, and invoke .NET injector routines. Associated campaigns have also performed antivirus discovery, Windows Defender tampering, UAC bypass, deletion of execution traces, and other defense-evasion actions.
HCrypt has been linked to phishing-driven and malspam-driven delivery, including HTML attachments that generate malicious ISO images locally, ISO files containing obfuscated script stagers, and phishing websites hosting lure content. Public file-hosting services and compromised websites have been used to stage intermediate payloads. Some reporting also associates HCrypt-generated payload chains with clipboard hijacking aimed at cryptocurrency theft, indicating that HCrypt has been used not only as a generic packer or protector but as an operational loader framework for multiple downstream malware families.
HCrypt is best characterized as an evasive Windows loader/crypter ecosystem rather than a single payload family. Its primary role is to conceal, deliver, and inject secondary malware while complicating static and behavioral detection through obfuscation, staged execution, reflective loading, and abuse of legitimate processes.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We encountered a fileless campaign that used a new HCrypt variant to distribute numerous remote access trojans (RATs) in victim systems. HCrypt is a crypter and multistage generator that is considered difficult to detect.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Water Basilisk’s attack chain is a combination of the VBScript and PowerShell commands.
The final stage is an obfuscated PowerShell script that contains the payloads and is responsible for deobfuscating and injecting them into the assigned process.
The HTA contains VBScript code within the HTA script tags... set HBBB = GetObject(...) Execute ( " HBBB.Run HB+HBB, 0, True " )
The JavaScript inside contains document.write() and unescape() function calls. This means the actual contents of the HTA file are a bit obfuscated using URL encoding and will be deobfuscated and written into an HTML document in memory at the time of rendering.
The code contains references to kernel32, LoadLibraryA, and GetProcAddress. These references mean the code likely imports additional native, non-.NET DLL functions at runtime for its injection operations.
One of my colleagues made a statement recently about how commonplace process injection has become among malware... many adversaries deploying malware have begun using crypters like HCrypt or Snip3 that inject their arbitrary payloads into other arbitrary processes... analyzing a malware payload protected using HCrypt and injected into aspnet_compiler.exe.
This means the actual contents of the HTA file are a bit obfuscated using URL encoding... There’s quite a bit of string obfuscation going on here as well... two really large hex-encoded strings... some base64 code at the bottom of the script that has some string obfuscation inside that gets replaced/removed during runtime.
The malicious file is hidden as an ISO that is distributed through a phishing email or website.
One of my colleagues made a statement recently about how commonplace process injection has become among malware... many adversaries deploying malware have begun using crypters like HCrypt or Snip3 that inject their arbitrary payloads into other arbitrary processes... analyzing a malware payload protected using HCrypt and injected into aspnet_compiler.exe.
This script deobfuscates a PowerShell command... The Powershell decodes the blob... it decrypts the blob
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Crypter-as-a-service referenced as part of the campaign evolution and delivery chain associated with the AsyncRAT campaign.
A loader used to deliver downstream RAT payloads including njRAT and AsyncRAT.
A crypter used to protect and deliver arbitrary payloads, including by loading an injector DLL and injecting a payload into another process such as aspnet_compiler.exe.
Crypter-as-a-service and multistage loader used to obfuscate delivery chains and load/inject final payloads in memory via VBScript and PowerShell. In this campaign it distributed multiple RAT payloads, achieved persistence, and also supported crypto-address hijacker payload generation.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.