Crypter-resistant defence starts with behaviour, not signatures

What happened: antivirus evasion became a repeatable service

The ACSC describes a commercial ecosystem in which criminals submit malware to a crypter, receive a transformed executable and check the result using counter-antivirus services that do not share detections with legitimate threat-intelligence feeds. Providers may re-crypt a payload whenever antivirus products begin recognising it, creating many signatures from the same underlying malware and shortening the useful life of a file indicator.

The techniques are not limited to encryption. The advisory identifies code obfuscation, polymorphic and metamorphic changes, packing, process hollowing, code injection, DLL side-loading, sandbox evasion, delayed execution and dynamic payload delivery. Some of those methods also have legitimate uses, so a single technical characteristic is not automatically proof of malware. Context and behaviour remain essential.

Why it matters: a negative file scan is not a release decision

Signature sharing still has value, but a rapidly changing payload can outrun hash and file-pattern blocking. Organisations that treat an antivirus 'clean' result as approval to execute an attachment, installer or downloaded tool leave a gap between initial screening and runtime detection. The risk is especially high where users can run unapproved software or where endpoint telemetry is missing from high-value servers.

The advisory also changes how defenders should judge coverage. Installing an EDR agent is not enough if the service cannot observe suspicious memory allocation, reflective loading, process manipulation or the child processes created by common delivery paths. Controls need to be tested against representative behaviours, and the resulting alerts must reach a responder with enough context and authority to contain the endpoint.

The practical implication: control execution and verify runtime evidence

Start with application control across workstations, internet-facing systems and internal servers, using an explicit allow policy for approved software and scripts. Review exceptions, local-admin rights and common execution routes such as Office add-ins, script interpreters, temporary directories and user-writable paths. Application control reduces the opportunity for an unknown payload to run even when its signature is new.

Configure EDR or host intrusion prevention on workstations, critical servers and high-value systems, then confirm that behaviour detections are enabled and monitored. Keep antivirus signatures current while also enabling heuristics, reputation checking, ransomware protection and scheduled full scans. These layers complement each other; behavioural monitoring does not make basic prevention or patching optional.

Finally, run a safe validation exercise using approved simulations rather than live malware. Confirm that an attempted unauthorised execution is blocked or generates usable telemetry, that memory and process activity is visible, and that alerts arrive in the correct queue. Record the device coverage, policy version, observed event, response time and containment outcome. That evidence turns a product deployment into a defensible control.