New TangleCrypt Packer Hides EDR Killer, But Coding Flaws Cause Ransomware to Crash Unexpectedly

The article discusses the discovery of "TangleCrypt," a new malware packer identified by WithSecure’s STINGR Group during an investigation of a Qilin ransomware attack. TangleCrypt employs advanced encryption techniques to hide its payload, known as STONESTOP, which is designed to terminate security software. Despite its sophisticated design, the packer contains critical coding flaws that can cause it to crash unexpectedly.

The malware uses a multi-layered obfuscation method, embedding its malicious code within the file's resource section and allowing attackers to choose how the malware executes. However, errors in its implementation lead to instability, particularly when administrative privileges are not granted. The findings highlight the varying quality of malware tools in the cybercriminal underground and emphasize the need for defenders to adapt to evolving threats.