Scrubcrypt

ScrubCrypt is a sophisticated malware that has been used as a delivery mechanism for other malicious software, notably VenomRAT. The malware operates by exploiting systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside the system, ScrubCrypt can disrupt operations, steal personal information, and even hold data hostage for ransom. Its functionality includes a batch file named "pointer.cmd," which serves as the ScrubCrypt batch file, and it employs multiple layers of obfuscation and evasion techniques to avoid detection. In April, FortiGuard Labs uncovered an intricate attack involving ScrubCrypt. The malware was leveraged to distribute and execute VenomRAT, another malicious program. This process involved several steps: first, the ScrubCrypt .NET file loaded Remcos from resource data "P"; then, the Guloader PowerShell was employed. The configuration for Remcos was RC4 encrypted in the "SETTINGS" resource, with decrypted data shown subsequently. The distribution of this plugin was facilitated through VenomRAT's C2 using three methods: an obfuscated VBS script named "remcos.vbs", ScrubCrypt itself, and Guloader PowerShell. Notably, the developers of Jlaive, BatCloak, CryBat, Exe2Bat, ScrubCrypt, and a social media distributor acknowledged their involvement on the SeroXen website. As a result of these activities, ScrubCrypt has been repeatedly linked to the distribution of VenomRAT and other malicious plugins, raising significant cybersecurity concerns.