The Old Phantom Crypter: A Mysterious Kit Behind the EQN_Kit2 Malware

The crypting scene has seen a significant shift in recent months, with new players emerging and old ones disappearing from the radar. One of the most notable newcomers is The Old Phantom Crypter, a mysterious kit that has generated a large number of malware samples with distinctive characteristics. In this article, we will delve into the world of exploit builders and explore the rise of The Old Phantom Crypter.

It all started as a PE cryptor, but The Old Phantom Crypter evolved to become a full-fledged exploit builder. For the past 11 months, we have been tracking EQN_Kit2, a kit that was previously unknown to us. Our research revealed that this kit is actually an alias for The Old Phantom Crypter, which has been actively used and updated since its inception.

In Q3 of 2018, we observed that maldocs created by the top four exploit builders accounted for over 75% of all malspam attacks. However, the landscape changed dramatically towards the end of last year, with the dominant 'brands' of maldoc builder tools such as Microsoft Word Intruder, Ancalog, and AKBuilder being abandoned. The Old Phantom Crypter emerged as one of the most prominent newcomers, replacing both old exploits and exploit builders.

Studying these builders often reveals trends that victims are likely to see in the malspam they receive. Maldocs are created by criminals who use tools called 'builders' that automate the process of embedding any number of exploits into the malware. We regularly publish reports about malicious Microsoft Office documents used in attacks, and The Old Phantom Crypter is a key player in this ecosystem.

The rise of The Old Phantom Crypter has significant implications for the cybersecurity community. As we continue to monitor its activity, we may uncover new trends and tactics that can help us better anticipate and prepare for future attacks. In our research paper, we provide more details on the characteristics of this kit and the malicious documents created with it.

In conclusion, The Old Phantom Crypter is a mysterious kit that has made a significant impact on the crypting scene. Its ability to adapt and evolve quickly makes it a force to be reckoned with, and we will continue to monitor its activity closely. By understanding the tactics and trends of this kit, we can better protect ourselves against future attacks and stay ahead of the threat actors.

Crypter 2018