It's an old trick. In the cybercriminal world there's a service called 'crypting'. It's used to delay or remove detection of malware samples by anti-virus produ

It's an old trick. In the cybercriminal world there's a service called 'crypting'. It's used to delay or remove detection of malware samples by anti-virus products. It's easy to build one with the right technical skills. It's one of four things that you need for a succesfull campaign really: A viable piece of malware (nowadays probably ransomware, in the past it was banking malware) Infrastructure (servers for updates and command and control) A speading method (spamruns, phishing, exploits etc.) A way for retaining infections (keeping your malware of the radar, updating the binary) The problem for many newbies in the cybercrime world is that the good crypters (any crypter at all really) cost money. A newbie can't program anything themselves, and don't want to spend money. So they go for one of the 'free' crypters. Obviously the malware obfuscated with one of the free crypters will contain a little 'extra'. This is a beneficial scheme for all the parties involved, the inexperienced newbies have access to tools to obfuscate their third-rate malware, the more experienced members benefit from some extra spreading of their own malware for free and with minimal ties to themselves. Perhaps this will become less viable for criminals in the future because ransomware does not play well with any other infection on the system. As opposed to adding some banking malware to a newbies RAT. All the other free tools are probably full of 'extras' too, with the rare exception of a free tool released purely for reputation gains and vouches.