Asgard Malware Protector Reversed: Researchers Expose Its Antivirus Bypass Methods

SpyCloud Labs analysts have reverse‑engineered Asgard Protector, a sophisticated crypter tool that cybercriminals use to hide malicious payloads from antivirus detection systems, with LummaC2 operators cited as a primary user. The service is advertised on underground forums and operated via an automated Telegram bot that generates crypted stubs with features such as IP logging, anti‑virtual machine detection, and autorun capabilities.

The crypter delivers via Nullsoft Installation Binaries, disguising critical batch files with extensions like .pst to evade initial triage, while memory‑based payload injection decrypts the true code in memory using RC4 and reconstructs the AutoIt binary through embedded CAB archives. It typically injects into explorer.exe, providing persistence and network access, and employs sandbox evasion by pinging randomly generated domains to distinguish real environments from sandboxes.

Analysis of over 1,200 Asgard Protector samples shows LummaC2 dominating the distribution at about 69% and Rhadamanthys at 11%, with misidentification by some antivirus vendors as CypherIT, suggesting shared code or mimicry.