crypter

A crypter is a software tool that encrypts or obfuscates executable code or data, often by wrapping the payload in an encrypted layer and providing a small decrypted loader that unpacks the payload at run time. While the term can apply to legitimate software protectors and packers, it is also associated with tools used to conceal malware from defenders.

Legitimate crypters are used to protect intellectual property, prevent tampering, and obfuscate code to hinder reverse engineering. Software protectors, license enforcement, DRM, and secure software distribution may employ crypters or packers.

Most crypters operate by encrypting the payload and installing a decryption stub in memory. At execution, the stub decrypts the payload into memory and transfers control. Techniques vary, including multiple layers of encryption, compression, and anti-analysis features designed to thwart static and dynamic analysis (e.g., anti-VM, anti-debugging).

Because crypters are commonly used in malware campaigns to elude antivirus detection, their use raises legal and ethical concerns. Some jurisdictions regulate or prohibit distributing tools whose primary purpose is evasion. Security researchers study crypters to develop detection methods, while defenders may use legitimate obfuscation techniques as part of software protection; however abuse can lead to harm.

See also: obfuscation, packer, malware, cryptography.