An encrypted module is a malware component stored in encrypted form until a loader decrypts it at runtime. This packaging hides the payload from quick inspection, file scanning, and some static analysis tools. Security teams may see only a wrapper, stub, or decryptor, while the real malicious code remains unreadable until execution.
This matters because encrypted modules help attackers delay detection and complicate triage. They are often used in staged infections, where one component fetches or unlocks the next. Defenders look for the surrounding behavior instead of the file alone: suspicious process chains, unusual decryption routines, archive handling, memory-only execution, and outbound requests that match staged delivery. Encryption does not make malware harmless; it mainly raises the work needed to inspect it before it runs and to reconstruct what it does afterward.