Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation

Unit42 analyzes HeartCrypt, a packer‑as‑a‑service (PaaS) that has been used since mid‑2023 to obfuscate and distribute malware by injecting multi‑layer position‑independent code and encoded payloads into legitimate Windows binaries; HeartCrypt (publicly marketed since Feb 2024) has packed over 2,000 payloads across ~45 malware families (notably Remcos, LummaStealer and Rhadamanthys), employs resource‑based execution, sandbox and Windows Defender evasion, and lowers the barrier for crimeware operators—report includes detailed technical breakdowns, automated extraction techniques, a YARA rule and IOCs.