Cruciferra Crypter Uses Vulnerable Drivers and Process Ghosting to Hide Malware

A commercial cybercrime service called Cruciferra is helping attackers conceal remote access trojans and information stealers from Windows security tools. The crypter combines payload encryption, endpoint defense tampering, privilege elevation, persistence, and memory-based execution techniques.

Cruciferra has been advertised on underground forums since fall 2025. Its seller offers subscription tiers costing between $450 and $2,000 per month, with more expensive packages providing additional evasion features.

Proofpoint identified the service in dozens of email campaigns conducted by several unrelated threat actors. The Cruciferra technical analysis links it to attacks delivering AsyncRAT, XWorm, Remcos, Formbook, XLoader, Agent Tesla, zgRAT, and other commodity malware.

What Is the Cruciferra Crypter?

A crypter encrypts or transforms malicious software to make it harder for security products to identify. It does not necessarily provide the final spying, credential theft, or remote access capabilities itself.

Instead, Cruciferra protects another malicious program selected by its customer. The service can embed that payload inside the crypter, load it from another file in the delivery archive, or download it from a staging server.

Proofpoint describes Cruciferra as an umbrella name covering a collection of related crypters. Researchers concentrated on the version they encountered most frequently during active campaigns.

Cruciferra detail	Finding
First advertised	Fall 2025
Subscription price	$450 to $2,000 per month
Development environment	Mono
Observed distribution	Primarily email-based campaigns
Campaign volume	Several hundred to thousands of messages
Development status	Active, with production and apparent testing variants
Primary purpose	Concealing and executing RATs, stealers, and other malware

Cruciferra Spreads Through Phishing Emails

Observed campaigns commonly begin with phishing messages containing links, PDF documents, compressed archives, or virtual hard disk files. The attackers use recognizable organizations and urgent subjects to persuade recipients to open the downloads.

Some archives contain a legitimate executable beside a malicious DLL. When the recipient launches the executable, Windows loads the nearby DLL through DLL side-loading, allowing Cruciferra to begin running.

Attackers may also use shortcut files and PowerShell commands to start the infection chain. The exact delivery method varies because different cybercrime groups can purchase and configure the service.

Tax-Themed Attacks Delivered AsyncRAT

Between late April and early June 2026, Proofpoint observed four campaigns attributed to TA4922, a suspected Chinese-speaking cybercrime actor. Each campaign contained up to 250 messages.

The emails impersonated the Government of India or Income Tax Department and warned recipients about tax violations, penalties, or compliance problems. Links led to fake tax portals hosting ZIP archives.

Opening the downloaded archive and launching its executable started Cruciferra through DLL side-loading. The crypter then deployed AsyncRAT, giving the attackers remote access to the infected Windows computer.

Other Campaigns Used SSA and Hotel Complaint Lures

Another campaign impersonated the US Social Security Administration. Messages referred to tax documents and deadlines before directing recipients to download malicious virtual hard disk files.

Proofpoint connected this activity with Cruciferra packages that delivered XWorm. XWorm can provide remote control, data theft, command execution, and other post-infection capabilities.

A June 2026 campaign targeted hospitality and travel organizations with complaints involving guests and bed bugs. Shortcut files and PowerShell eventually downloaded Cruciferra, which deployed zgRAT.

Which Malware Families Use Cruciferra?

Cruciferra does not lock its customers to one final payload. Threat actors can use the crypter to protect different malware families depending on their campaign and intended victims.

Malware family	General capability
Agent Tesla	Credential and information theft
AsyncRAT and DCRAT	Remote access and system control
DarkCloud Stealer	Browser, account, and system-data theft
Formbook and XLoader	Credential theft, data collection, and malware downloading
PhantomStealer	Information theft
Remcos	Remote access and surveillance
Snake Keylogger	Keystroke and credential collection
ValleyRAT	Remote access and follow-on malware delivery
XWorm	Remote control and information theft
zgRAT	Remote access and system-data collection

Cruciferra Checks for Analysis Systems

Before releasing its payload, Cruciferra examines the environment for evidence of sandboxes, debuggers, and virtual machines. Malware researchers commonly use these controlled systems to observe suspicious files safely.

Cruciferra also includes decoy DLL exports that lead automated tools toward harmless code. This can waste analysis time and make a malicious library appear less suspicious during a quick inspection.

Proofpoint found production builds alongside apparent testing samples containing debugging and experimental features. New builds appeared in malware repositories frequently, sometimes only minutes apart.

BYOVD Attacks Can Terminate Security Processes

One of Cruciferra’s more dangerous options uses Bring Your Own Vulnerable Driver, commonly shortened to BYOVD. This technique abuses legitimate but vulnerable kernel drivers that still carry trusted digital signatures.

After gaining elevated privileges, malware can load one of these drivers and exploit its low-level access. Cruciferra can then send commands through the driver to terminate selected endpoint security processes.

This does not guarantee that every EDR platform will stop working. The result depends on administrator access, whether Windows permits the driver to load, the driver’s vulnerability, and the security product’s protections.

Microsoft’s recommended vulnerable driver blocklist aims to prevent known dangerous drivers from loading. Microsoft updates the operating system’s blocklist through regular Windows servicing.

Cruciferra Uses Several Vulnerable Drivers

Proofpoint identified eight drivers packaged with Cruciferra samples for potential BYOVD activity. Different builds may contain different selections from this collection.

Driver	SHA-256
Core64.sys	17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc4
GoFlyDrv.sys	2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a
HwOs2Ec.sys	c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c
LnvMSRIO.sys	c5b1e9aafc8f2b4ab05effc00fd43f3114b9ef1d592a086c952793ac4e299809
MemoryInformer.sys	7887e919555fb5948c217556ba149392a72982b1bc427d3db779db9dcbf09ee8
NTIOLibX64.sys	09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1
ProcessMonitorDriver.sys	5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df
selfprot.sys	c46e907886e2158cbc453e767183aecf07887b5ac8848f19684451883d69f5f0

Microsoft also provides an attack surface reduction rule designed to stop applications from writing exploited vulnerable signed drivers to disk. The rule does not stop a driver that already exists on the computer from loading.

The Microsoft Defender ASR rule reference recommends combining that rule with the vulnerable driver blocklist or an App Control policy for broader protection.

Indirect System Calls Help Bypass Monitoring Hooks

Endpoint products often monitor sensitive Windows functions by placing hooks inside system libraries. These hooks allow defensive software to inspect suspicious memory operations and process activity.

Cruciferra reads a clean copy of ntdll.dll and collects pointers to selected system-call stubs. It can then call lower-level Windows functions while avoiding some hooks placed by EDR or sandbox products.

The crypter uses this method with functions related to memory protection, section creation, registry access, file handling, and memory mapping. Security tools can still detect associated behavior through other telemetry and kernel-level monitoring.

IAT Repair Removes Another Monitoring Layer

Cruciferra also repairs the Import Address Table, or IAT. Windows programs use this table to locate functions imported from other libraries.

Security and analysis tools can modify IAT entries to monitor calls. Cruciferra attempts to identify those changes and restore the original function addresses.

Proofpoint noted that IAT hooking represents an older monitoring approach, making Cruciferra’s dedicated repair capability unusual. Its inclusion shows that the developers support several overlapping evasion methods.

Cruciferra Seeks Administrator Privileges

The crypter checks whether it already has administrator privileges. If not, it can attempt to bypass User Account Control through a Windows COM elevation mechanism.

Administrator access increases the malware’s ability to change security settings, load vulnerable drivers, interfere with other processes, and establish system persistence.

Cruciferra creates persistence through a Windows Run registry key using the value name “putty.” This causes the malware to start again when the user signs in after a reboot.

Windows Notifications Can Be Suppressed

Cruciferra modifies registry settings related to toast notifications, classic notification balloons, and file information tips. These changes can make suspicious activity less visible to the user.

Suppressing notification interfaces may prevent some Windows Defender, SmartScreen, or Security Center messages from appearing normally. It does not necessarily disable the underlying security feature.

Security teams should therefore monitor registry modifications affecting Windows notifications, especially when they occur near unexpected archive execution, PowerShell activity, or driver installation.

More Than 90 Encryption Variations Protect Payloads

Proofpoint found that Cruciferra supports more than 90 encryption and decryption routines. Many combine selected components from established cryptographic algorithms rather than implementing one complete standard algorithm.

One build might combine a key-scheduling method from one design with operations taken from another cipher or pseudorandom number generator. This produces substantial variation between packed samples.

The same malware payload can therefore appear different across campaigns. This reduces the reliability of static signatures that depend on matching fixed byte sequences.

Process Ghosting Removes the Backing File

Cruciferra uses a modified form of Process Ghosting to execute its final payload. It creates a temporary file, marks it for deletion, writes the payload, and creates an executable image section from that file.

Windows deletes the file after the relevant handle closes, but the mapped image section remains available in memory. Cruciferra maps this section into a suspended legitimate process, redirects execution, and resumes the process.

The payload can continue running even though its backing file no longer exists in a normal scannable state. Memory, process, registry, driver, network, and event-log artifacts may still reveal the infection.

Additional Hooks Attempt to Hide the Ghosted Image

Cruciferra adds two anti-monitoring changes to its Process Ghosting implementation. One targets ZwQueryVirtualMemory, a function security tools can use to examine a process’s memory regions.

The crypter attempts to return sanitized information when a defensive tool checks the ghosted memory. This may conceal evidence that the backing file has been deleted or does not match the running image.

Cruciferra also interferes with NtManageHotPatch, which Windows can use when validating loaded image sections against files on disk. Disrupting this function may make the ghosted payload harder to inspect.

How Organizations Can Detect Cruciferra

Defenders should combine email filtering, endpoint behavior monitoring, PowerShell logging, driver controls, and memory analysis. Hash or domain blocking alone may miss newly generated Cruciferra builds.

• Investigate unexpected ZIP, RAR, and VHD downloads delivered through email.
• Detect legitimate executables loading unusual DLLs from the same archive or directory.
• Monitor PowerShell launched through shortcut files or compressed attachments.
• Alert when unknown processes attempt to install or communicate with kernel drivers.
• Monitor attempts to terminate endpoint security processes.
• Detect suspicious changes to Windows notification registry values.
• Review new Run-key entries, including entries using misleading names.
• Look for suspended processes followed by unusual memory-section mapping.
• Correlate network connections with archive execution and DLL side-loading.
• Use memory scanning alongside conventional file scanning.

Security teams should apply current Windows updates and verify that the Microsoft vulnerable driver blocklist is enforced. Microsoft notes that the blocklist cannot cover every vulnerable driver and may require additional App Control policies.

Organizations using Microsoft Defender can consider the rule for blocking abused vulnerable signed drivers. Administrators should test security policies for compatibility before enforcing them across production systems.

Selected Cruciferra Indicators of Compromise

The following indicators come from Proofpoint’s investigation. URLs and domains have been defanged to prevent accidental connections. Defenders should use them with behavioral evidence because threat actors can replace infrastructure quickly.

Type	Indicator	Description
URL	hxxp://hsahyteiows[.]gu[.]cc	TA4922 AsyncRAT payload URL, first seen April 28, 2026
URL	hxxp://yicoweytcbtw[.]gu[.]cc	TA4922 AsyncRAT payload URL, first seen April 28, 2026
URL	hxxp://nciyeyrawoe[.]gu[.]cc	TA4922 AsyncRAT payload URL, first seen April 28, 2026
URL	hxxp://lasiduutfe[.]gu[.]cc	TA4922 AsyncRAT payload URL, first seen April 28, 2026
SHA-256	3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e	Tax-Number52563.zip delivering AsyncRAT
SHA-256	66dbe675480dc229e5b3ab8ad74207f73486e64e57805074f784bb2e01bcb865	Tax-Number809863.zip delivering AsyncRAT
SHA-256	a6fb779be35592fb0ff624a8f8e12ab3cafe7bcfc312cd98263814db7fb01e02	Tax-Number119863.zip delivering AsyncRAT
SHA-256	59ad96dd3b4d5f10a5c53bbd465446e52dc7701a4ac633632f762bf1336d3347	Tax-Number101863.zip delivering AsyncRAT
SHA-256	6dbd6f9f2fa636c16ac4fa81418b68a604424861b9650dd9c4f2b0ba6f67d6ac	Tax-Number33863.zip delivering AsyncRAT
Domain	gatuso[.]duckdns[.]org	XWorm command-and-control server
SHA-256	3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d	photo295825092412.zip delivering zgRAT
Domain	0zbqnac1t4dv2t2wuodv1m[.]com	zgRAT command-and-control server
IP address and port	89[.]34[.]90[.]99:56001	zgRAT command-and-control server

The latest Proofpoint threat report contains the complete published indicator list, including additional payload URLs and first-seen dates.

FAQ