Acecryptor

AceCryptor is a malicious software (malware) that has been used extensively in phishing campaigns to protect and deliver other malware. In the second half of 2023, AceCryptor was notably employed to package Rescoms malware for distribution across Central and Eastern Europe, with the aim of stealing credentials and gaining initial access to company networks. Four dedicated IP addresses were associated with AceCryptor, two of which were categorized as malicious, hosting 279 domains, 17 of which were identified as harmful. However, a significant shift in delivery mechanisms occurred in May 2024 when threat actors began transitioning from AceCryptor to ModiLoader for disseminating malware, including Rescoms, Agent Tesla, and Formbook. This change reflects an ongoing effort by attackers to evade detection and increase their success rate. DNS lookups on these domains revealed they resolved to five unique IP addresses, none of which were previously included in the list of AceCryptor indicators of compromise (IoCs). Our latest research into general malware crypting services unearthed 786 potentially related artifacts, while investigations specific to AceCryptor led to nearly 300 DNS-connected properties. Despite this, AceCryptor continues to be recognized as a leading service in its field. With seven domains and three IP addresses linked to it, understanding and tracking the activities of AceCryptor remains crucial in the fight against cyber threats.