# Cruciferra Crypter MaaS Used to Conceal Infostealers and RATs (AsyncRAT, XWorm, zgRAT, Remus and others)

> Cruciferra is a Mono-based crypter-as-a-service sold on underground forums since fall 2025 ($450-$2,000/month) and used by multiple unrelated clusters, including TA4922, to deliver RATs and infostealers via phishing and ClickFix. It combines DLL side-loading, 90+ custom encryption routines, API/IAT unhooking, indirect syscalls, BYOVD EDR termination and a tweaked Process Ghosting loader.

- **Published:** 2026-11-12T13:35:39Z
- **Last reviewed:** 2026-11-14T09:46:46.764Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5861
- **ID:** TL-2026-5861
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** TA4922 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 51 (3 shown free below)

## Description

Cruciferra is a crypter-as-a-service written in Mono that wraps commodity malware to evade antivirus and EDR. Proofpoint (Threat Insight, 2026-07-20) describes it as an umbrella name for several bundled crypters, first offered in fall 2025 and advertised on the exploit.in forum and likely elsewhere, with tiered pricing of $450 to $2,000 USD per month. Per the Cyber Security News article of 2026-11-12, which cites ESET, the service has been sold since October 2025, is a rebrand of the long-running KGB cryptor, and ESET has blocked 700,000+ compromise attempts since January 2026 (Turkiye, Greece and Spain most affected). The ESET claims were not independently verified against an ESET primary publication; the cited source is an ESET X post. Proofpoint observed dozens of campaigns from several unrelated groups, each of several hundred to thousands of messages, with opportunistic targeting (financial services 34%, healthcare 25%, government 10%, education 7%).

Execution is always via DLL side-loading: a ZIP/archive (or VHD) contains a legitimate-looking executable plus a DLL holding the Cruciferra code, and the executable invokes the DLL's main routine. DLLs may carry hundreds or thousands of decoy exports pointing at junk code to slow analysis. The loader checks for sandboxes/analyst VMs, hides console windows (EnumWindows/ShowWindow SW_HIDE loop), suppresses notifications via registry (ToastEnabled, Balloon, ShowInfoTip), maps a clean copy of ntdll to unhook functions and repairs the IAT, and uses indirect syscalls (NtProtectVirtualMemory, NtCreateSection, NtMapViewOfSection, NtCreateTransaction, NtRollbackTransaction, NtOpenKey, NtSetValueKey, NtSetInformationFile). If not admin it attempts a UAC bypass through the COM Elevation Moniker, and persists with a Run key whose default value is 'putty'.

Payloads are stored in the .reloc section behind an 'egg' marker, encoded in Base16 with the custom alphabet 'PQRSTUVWXYZ[\]^_', and protected by 90+ hybrid encryption algorithm variants (Keccak, SPECK-128/256 CTR, modified Threefish-256 CTR, Feistel and ARX constructions, DES-CBC-PKCS7), often randomly generated per build; debug timestamps suggest a new build every few minutes. For EDR tampering the loader drops a signed vulnerable driver, most often GoFlyDrv.sys (also Core64.sys, HwOs2Ec.sys, LnvMSRIO.sys, MemoryInformer.sys, NTIOLib_X64.sys, ProcessMonitorDriver.sys, selfprot.sys) and sends termination IOCTLs to EDR processes; an eSentire-observed loader (as reported by Cyber Security News) used DCRCVDrv.sys to end 145 AV/EDR-related processes. Final injection uses a customised Process Ghosting that additionally patches ZwQueryVirtualMemory hooks to sanitize EDR memory queries and neuters NtManageHotPatch.

Observed campaigns: TA4922 (Chinese-speaking cybercrime actor, some overlap with Silver Fox per Security Affairs) sent four tax-themed waves (Income Tax Department of India lures, 28 Apr - 1 Jun 2026, up to 250 messages each) leading to AsyncRAT; a May 2026 campaign impersonating the US Social Security Administration used a VHD to deliver XWorm and AdaptixC2; a late-June 2026 guest-complaint campaign against hospitality/travel used a zipped LNK that launched PowerShell to fingerprint the host and download a ZIP delivering zgRAT. Other observed payloads include Agent Tesla, DarkCloud, Formbook/XLoader, PhantomStealer, Remcos, Snake Keylogger, ValleyRAT and, via an ErrTraffic ClickFix-linked loader reported by eSentire, Remus stealer. No CVEs are involved and no state attribution is stated.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1574.001 DLL
- T1055.013 Process Doppelgänging
- T1685 Disable or Modify Tools
- T1027.002 Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1112 Modify Registry
- T1564.003 Hidden Window
- T1588.001 Obtain Capabilities: Malware
- T1189 Drive-by Compromise
- T1106 Native API
- T1543.003 Create or Modify System Process: Windows Service
- T1055.012 Process Injection: Process Hollowing
- T1070.004 Indicator Removal: File Deletion
- T1102.001 Web Service: Dead Drop Resolver
- T1105 Ingress Tool Transfer

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Cruciferra Crypter DLL Side-Loading from Extracted Archive (mscoree.dll / Unsigned Neighbour DLL)** (`TL-2026-5861-SPL-001`)

Detects the Cruciferra crypter execution pattern: an executable launched from an extracted ZIP/RAR/7z archive (Temp\TempN_*.zip) that loads an unsigned DLL from that same archive folder (the DLL carries the Cruciferra payload and decoy exports), a mscoree.dll loaded from outside the Windows system/.NET directories (eSentire-observed Cruciferra DLL), or the known Cruciferra mscoree.dll SHA256. Cruciferra wraps AsyncRAT, XWorm, zgRAT, Remcos and other payloads, so catching the loader catches the delivery regardless of payload family.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.001, T1204.002, T1027.002
- **Data sources:** sysmon
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 earliest=-24h
```TL-2026-5861 Cruciferra DLL side-loading T1574.001 T1204.002 T1027.002 - requires Sysmon EventCode 7 image-load logging```
| eval is_archive=if(match(Image,"(?i)temp.temp[0-9]+_.+?[.](zip|rar|7z)."),1,0), arch_dir=lower(replace(Image,"(?i)^(.*temp.temp[0-9]+_.+?[.](zip|rar|7z)).*$","\1"))
| eval sideload_unsigned=if(is_archive=1 AND Signed="false" AND match(lower(ImageLoaded),"[.]dll$") AND substr(lower(ImageLoaded),1,len(arch_dir))=arch_dir,1,0)
| eval fake_mscoree=if(match(lower(ImageLoaded),"mscoree[.]dll$") AND NOT match(lower(ImageLoaded),"^c:.windows.(system32|syswow64|microsoft[.]net|winsxs)"),1,0)
| eval known_hash=if(match(lower(Hashes),"0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce"),1,0)
| where sideload_unsigned=1 OR fake_mscoree=1 OR known_hash=1
| stats count dc(ImageLoaded) AS dll_count values(ImageLoaded) AS loaded_dlls values(Hashes) AS hashes min(_time) AS first_seen max(_time) AS last_seen BY host, User, Image, sideload_unsigned, fake_mscoree, known_hash
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
// TL-2026-5861 Cruciferra DLL side-loading (T1574.001, T1204.002, T1027.002)
let knownHashes = dynamic(['0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce']);
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName endswith '.dll'
| extend ArchiveDir = tolower(extract(@"(?i)^(.*temp.temp[0-9]+_.+?[.](zip|rar|7z))", 1, InitiatingProcessFolderPath))
| extend SideLoad = isnotempty(ArchiveDir) and tolower(FolderPath) startswith ArchiveDir
| extend FakeMscoree = tolower(FileName) == 'mscoree.dll' and not(tolower(FolderPath) matches regex @"^c:.windows.(system32|syswow64|microsoft[.]net|winsxs)")
| where SideLoad or FakeMscoree or SHA256 in (knownHashes)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, FileName, FolderPath, SHA256, SideLoad, FakeMscoree
| order by Timestamp desc
```

### Sigma

```yaml
title: Cruciferra Crypter DLL Side-Loading from Extracted Archive
id: 7c1f3a52-9d84-4e0b-a3c6-51b8d2e49f10
status: experimental
description: Detects an unsigned DLL loaded by an executable running from an extracted archive folder (Temp TempN zip), a mscoree.dll loaded from outside the Windows system directories, or the known Cruciferra mscoree.dll hash (TL-2026-5861).
references:
    - https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service
    - https://cybersecuritynews.com/cruciferra-malware-as-a-service/
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.defense-evasion
    - attack.t1574.001
    - attack.execution
    - attack.t1204.002
    - attack.t1027.002
logsource:
    category: image_load
    product: windows
detection:
    selection_archive_exe:
        Image|re: '(?i)temp.temp[0-9]+_.+[.](zip|rar|7z).+[.]exe$'
        ImageLoaded|re: '(?i)temp.temp[0-9]+_.+[.](zip|rar|7z).+[.]dll$'
        Signed: 'false'
    selection_mscoree:
        ImageLoaded|re: '(?i).mscoree[.]dll$'
    filter_mscoree_legit:
        ImageLoaded|re: '(?i)^c:.windows.(system32|syswow64|microsoft[.]net|winsxs).'
    selection_hash:
        Hashes|contains: 'SHA256=0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce'
    condition: selection_archive_exe or (selection_mscoree and not filter_mscoree_legit) or selection_hash
falsepositives:
    - Portable applications run directly from an extracted ZIP that ship their own unsigned helper DLLs
    - Software installers extracted to Temp that load bundled unsigned DLLs
level: high

```

**Known false positives:**

- Portable applications run straight from an extracted archive that load unsigned helper DLLs
- Software installers unpacked under Temp that load bundled unsigned DLLs
- Developer tools executed from extracted archives

**Tuning notes:** Requires Sysmon EventCode 7 (ImageLoad) enabled. Adjust the index name (sysmon) to your environment. Allowlist known portable software by Image, signer or hash. For a very low-noise variant keep only the fake_mscoree and known_hash branches. Correlate with EventCode 11 (recent DLL creation) to raise confidence.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Cruciferra Delivery: Hidden PowerShell Download from LNK or ClickFix Command (locked: unlock with TL Creds)
- Cruciferra BYOVD: Vulnerable Driver Dropped, Registered as a Service or Loaded for EDR Termination (locked: unlock with TL Creds)
- Cruciferra RAT C2: User-Writable Process Beaconing to Dynamic-DNS Hosts, Port 56001 or Known C2 / Sibling C2 Endpoints (locked: unlock with TL Creds)
- Cruciferra Lure Archive Written to Disk (Tax-Number, photo, YourSSA_Documents) (locked: unlock with TL Creds)
- Cruciferra UAC Bypass via COM Elevation Moniker (CMSTPLUA dllhost Child Process / Elevation:Administrator!new Moniker) (locked: unlock with TL Creds)
- Cruciferra Final-Stage Injection: Process Ghosting / Image Tampering (Sysmon EventCode 25) (locked: unlock with TL Creds)
- Cruciferra Persistence: Run Key 'putty' and Notification Suppression Registry Writes (locked: unlock with TL Creds)
- Cruciferra Payload Staging and RAT C2 Infrastructure Contact (DNS and Network) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 51)

Defanged, TLP:CLEAR.

- IP address: `89.34.90[.]99`
- Domain: `gatuso[.]duckdns[.]org`
- URL: `hxxps://almacensantangel[.]com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar`

Full set of 51 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Unpacking 'Cruciferra': An Analysis of a Sophisticated Crypter Service (Proofpoint)](https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service)
- [Hackers Abuse Cruciferra Malware-as-a-Service to Conceal Infostealers and Remote Access Trojans](https://cybersecuritynews.com/cruciferra-malware-as-a-service/)
- [ESET Research post on Cruciferra (X)](https://x.com/ESETresearch/status/2120805423485702438)
- [This $2,000-a-Month Crypter Can Kill EDR and Make Malware Disappear From Disk](https://cybersecuritynews.com/this-2000-a-month-crypter-can-kill-edr/)
- [New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks Worldwide (Security Affairs)](https://securityaffairs.com/196151/malware/new-crypter-as-a-service-cruciferra-fuels-stealthy-malware-attacks-worldwide.html)
- [Cruciferra Crypter Uses Process Ghosting to Evade Detection (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/cruciferra-crypter-process-ghosting/)
- [Cruciferra Crypter Evades Detection to Deliver Malware (eSecurity Planet)](https://www.esecurityplanet.com/threats/cruciferra-crypter-evades-detection-to-deliver-malware/)
- [Cruciferra: Analyzing a Sophisticated Crypter Service (SOC Prime)](https://socprime.com/active-threats/cruciferra-analyzing-a-sophisticated-crypter-service/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5861