TangleCrypt Packer Uses ABYSSWORKER Driver to Evade EDR and Deliver Ransomware

WithSecure’s Strategic Threat Intelligence & Research Group (STINGR) has disclosed a detailed technical analysis of TangleCrypt, a previously undocumented Windows malware packer discovered during an investigation into a Qilin ransomware attack from early September 2025.

The packer was found protecting executables containing STONESTOP, an EDR killer that leverages the malicious ABYSSWORKER kernel driver to terminate security products on compromised systems.

TangleCrypt employs a sophisticated approach to concealing malicious payloads within Windows executables.

The payload is stored inside PE Resources through multiple layers of protection base64 encoding, LZ78 compression, and XOR encryption making static analysis considerably more challenging for security researchers.

A small encrypted entry in the resources contains a numeric key (such as “175438”) that decrypts the primary payload after multiple decompression stages.

The packer supports two execution methods for launching decrypted payloads: injection within the same process or deployment through a child process.

In ‘4cBh.exe’, the original payload is decrypted in its own process memory, while ‘b1.exe’ starts a child process of itself and writes the decrypted payload to that process.

This behavior is controlled by a configuration string appended to the embedded payload, with strings like “exex64_amd64_block_” triggering same-process injection and “exex64_amd64__riin” initiating child process deployment.

EDR Killing Mechanism

Upon execution, STONESTOP first verifies elevated privileges, restarting with admin rights if necessary.

The malware then registers the ABYSSWORKER driver which masquerades as a legitimate CrowdStrike Falcon Sensor driver and uses it to terminate running processes matching a predefined list of security products.

The executable maintains background persistence, repeating process termination every second to ensure security tools remain disabled.

WithSecure’s investigation revealed that STONESTOP variants target Microsoft Defender alongside one or two additional EDR/AV vendors, though some samples were found targeting up to six different security products.

The ABYSSWORKER driver in this case was protected with VMProtect, consistent with most samples observed in the wild.

Despite its layered encryption approach, TangleCrypt’s anti-analysis mechanisms proved relatively straightforward to bypass.

The packer employs string encryption through dedicated decryption functions, dynamic import resolving, and intentionally unoptimized code to slow debugging.

However, researchers found that setting strategic breakpoints on shared decryption routines could reveal hidden strings efficiently.

Critical Implementation Flaws

A notable discovery was that TangleCrypt contains several implementation bugs that can cause packed executables to crash unexpectedly.

The process and set a breakpoint on this API (in WinDbg: “bu kernel32!VirtualAlloc”), the target will hit the breakpoint after a few seconds.

The only anti-debugging measure identified involves calling LocalHandle and GlobalSize with null arguments to trigger Access Violation exceptions a technique easily bypassed by configuring debuggers to ignore such exceptions or simply continuing execution.

One sample crashed when executed without administrator privileges due to TangleCrypt’s incomplete re-implementation of the MSVCRT.DLL ‘_getmainargs’ function, which failed to initialize the ‘pgmptr’ variable required for the payload’s self-elevation routine.

Additionally, TangleCrypt discards original Thread Local Storage (TLS) information from packed executables a design choice that, while not directly causing crashes in the analyzed samples, could create compatibility issues with other payloads relying on TLS callbacks.

WithSecure products now detect TangleCrypt-packed samples as “Trojan:W32/TangleCrypt.A”.

The packer’s payload-agnostic architecture makes it suitable for hiding virtually any Windows malware, though its implementation inconsistencies may explain its limited adoption compared to established packers like HeartCrypt and VMProtect.

This discovery underscores that threat actors continuously experiment with new tooling to bypass detection, and defenders must remain vigilant against both sophisticated and imperfect implementations appearing in real-world attacks.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.