AceCryptor, a prominent crypter malware that has been used to pack a handful of malware strains since 2016, has been detected 240,000 times between 2021 and 2022, accumulating over 10,000 hits per month. Unlike packers that use compression to obfuscate code, crypters use encryption to enhance stealth and increase the difficulty of reverse engineering. Researchers found that AceCryptor contained prominent malware families including SmokeLoader, RedLine Stealer RanumBot, Racoon Stealer, Stop ransomware, Amadey, and more. AceCryptor is sold to threat actors in a crypter-as-a-service (CaaS) format, and it’s been observed being used to propagate a wide host of malware families by a multitude of threat actors. It can be both time-consuming and technically difficult for threat actors to maintain their own crypters that are difficult to detect, leading crimeware threat actors to seek CaaS options to pack malware. AceCryptor is heavily obfuscated with a three-layer architecture that decrypts and unpacks at each stage to eventually launch the payload and contains anti-VM, anti-debugging, and anti-analysis features to help avoid detection. AceCryptor’s malware is delivered using trojanized installers of pirated software, malicious links embedded in phishing emails, or with the help of other malware that has already compromised a host.