Cruciferra Crypter Uses BYOVD and Process Ghosting to Evade Detection

Cruciferra Crypter Emerges

A China-linked cybercrime group, previously targeting Indian taxpayers with phishing lures, has been observed using a sophisticated crypter service named Cruciferra. This service is utilized by various cybercriminal threat clusters to distribute a wide range of remote access trojans (RATs) and information stealer malware.

Advanced Evasion Techniques

Cruciferra, written in Mono, incorporates numerous techniques to evade detection, analysis, and incident response. These include indirect system calls, API and Import Address Table (IAT) unhooking, and bring-your-own-vulnerable-driver (BYOVD)-based EDR tampering. It also features privilege escalation, persistence mechanisms, and a customized implementation of Process Ghosting to execute payloads while minimizing forensic artifacts.

Polymorphic Encryption

The crypter emphasizes payload protection and supports custom encryption routines that appear to be dynamically derived and assembled from established cryptographic algorithms. This introduces variations between samples, complicating static analysis and signature-based detections. Researchers note that the encryption algorithm varies significantly between samples, suggesting polymorphic generation from elements of well-known hashing, PRNG, and cipher algorithms.

Widespread Distribution and Cost

Cruciferra has been advertised on the cybercrime underground as the "most lethal crypter" for $450 to $2,000 per month, first becoming available in fall 2025. It has been used to distribute commodity malware families such as Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm, and zgRAT. Phishing is the primary initial access vector for campaigns leveraging this crypter, which can either drop an encrypted payload to disk or download it from a staging server.