# VIP Crypt and ASMCrypt: Commercial Crypter Services Enabling Malware Evasion of Windows Defenses

> Recorded Future's Insikt Group profiled 24 active malware-crypting-service providers, including VIP Crypt (operator mrlapis, $500/week) and ASMCrypt (operator o1oo1, $3,000/month, bundled with the TOP RAT/SnappyClient for $7,000/month), which sell multi-stage Delphi loaders, AMSI/ETW bypasses, direct syscalls, manual PE mapping, and anti-VM/anti-debug checks to help commodity stealers, RATs, and ransomware loaders such as HijackLoader evade Windows Defender and EDR.

- **Published:** 2026-08-14T00:00:00Z
- **Last reviewed:** 2026-08-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2014
- **ID:** TL-2026-2014
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Crypting-as-a-service has matured from simple binary obfuscation into full 'malware-enablement services' combining payload encryption, anti-analysis tooling, process injection, and persistence support behind subscription storefronts on forums such as Exploit, Telegram, Tox, and Jabber. Recorded Future's Insikt Group analyzed 24 such providers active over the past year; this threat tracks the report's two flagship offerings plus closely related actors it names.

mrlapis has operated VIP Crypt since 2011 (~$83,000 in estimated proceeds), selling a $500/week subscription that wraps 64-bit .exe/.dll payloads in a multi-stage Delphi loader: hidden resource-based storage, AES-256 encryption with in-memory decryption, manual PE mapping that bypasses the standard Windows loader, and runtime re-encryption of the stub roughly every 10 minutes to defeat static signatures. The service is fronted by a Telegram handle (@mrlapis_real), a Tox ID, and a Jabber address on exploit.im, with an AirVPN (Latvia) egress IP and two FTPS delivery servers used to hand off encrypted builds to customers.

o1oo1 has run ASMCrypt (and the bundled TOP RAT/SnappyClient) for roughly five years, generating an estimated $3.6 million; ASMCrypt is priced at $3,000/month standalone or $7,000/month bundled with the RAT. It targets polymorphic .NET (x86/x64) payloads, offers customizable anti-VM checks (RAM size, CPU model, hypervisor artifacts, MAC address, GPU name), and can add Windows Defender exclusions without invoking PowerShell. Its headline feature is integration with HijackLoader, a modular loader independently documented (by CrowdStrike and others) using interactive process hollowing of a pipe-fed cmd.exe, a transacted-section 'process doppelgänging' write into a spawned logagent.exe, and standard DLL hollowing of the legitimate mshtml.dll. HijackLoader implements Heaven's Gate (x86-to-x64 mode switching) to remap ntdll and issue direct/indirect syscalls — NtCreateSection, NtMapViewOfSection, NtWriteVirtualMemory, NtProtectVirtualMemory, NtResumeThread, and related APIs — bypassing user-mode EDR hooks, and decodes its configuration via XOR followed by LZNT1 (RtlDecompressBuffer) decompression. HijackLoader has been used across the industry to deliver Cobalt Strike beacons, LummaC2, RedLine Stealer, Danabot, and SystemBC, among other stealer/RAT payloads.

Insikt Group's broader market snapshot names related actors relevant to this same crypting-service ecosystem: ImComplexed's Private Protector (active since July 2020, tiers from $1,000 one-time to $12,000-$20,000/month, x64/x86/ARM support), separately reported by Intel 471 as having been used to protect payloads for the Conti, Egregor, Mount Locker, Quantum, and Hive ransomware operations, with a 'SPECTRE BOT Runtime Test' update in April 2026; and memory_lost (aliases CrackingCore, donovanranda), who ran a crypting service from January 2021 until arrest by the Cyber Police of Ukraine on 12 June 2024, allegedly having encrypted BlackMatter, Conti, LockBit, and REvil samples for $100/file or $5,000/month for automated re-encryption.

Across the market, providers advertise Windows Defender/SmartScreen bypass, AMSI bypass, ETW patching, syscall unhooking, sandbox-evasion sleep delays, and registry-based tamper protection, paired with persistence via Run keys, scheduled tasks, services, WMI subscriptions, and BITS jobs, and validate 'fully undetectable' (FUD) status using scanning services such as avcheck.net, scanner.to, and (with detection-leak risk) public VirusTotal submissions. Recorded Future explicitly cautions that provider-advertised evasion claims should be treated as marketing unless corroborated by sample analysis, and that the significance of this market is the commodification and packaging of established tradecraft — not technical novelty.

## MITRE ATT&CK

- T1027.002 Obfuscated Files or Information: Software Packing
- T1027.009 Obfuscated Files or Information: Embedded Payloads
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1055.012 Process Injection: Process Hollowing
- T1055.013 Process Doppelgänging
- T1574.001 DLL
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools
- T1622 Debugger Evasion
- T1497 Virtualization/Sandbox Evasion
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1106 Native API
- T1518.001 Software Discovery: Security Software Discovery
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

## Sources

- [Malware Crypting Services: 24 Threat Actors and Their Tradecraft](https://www.recordedfuture.com/research/malware-crypting-services-threat-actors)
- [Malware Crypter Services Enable Attackers to Bypass Windows Security Defenses](https://cybersecuritynews.com/malware-crypter-services/)
- [24 Malware Crypter Sellers Turn EDR Evasion and In-Memory Execution Into Paid Services](https://gbhackers.com/24-malware-crypter-sellers/)
- [A Briefing on Malware Crypting Services](https://www.intel471.com/blog/a-briefing-on-malware-crypting-services)
- [HijackLoader Expands Techniques to Improve Defense Evasion](https://www.crowdstrike.com/en-us/blog/hijackloader-expands-techniques/)
- [ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories](https://thehackernews.com/2026/08/threatsday-ghostjacking-ai-attacks.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2014