Date: 07/21/2026
Severity: High
Summary
Researchers are tracking Cruciferra, a crypter service used by multiple unrelated threat actors to conceal malware and improve delivery success. Built on Mono, it includes advanced evasion techniques such as indirect system calls, API/IAT unhooking, BYOVD-based EDR tampering, privilege escalation, persistence, and Process Ghosting. The crypter also focuses heavily on payload protection through numerous custom encryption methods that vary across samples. This constant variation makes static analysis and signature-based detection much more difficult for defenders. Researchers observed both production and testing variants, including samples with debugging and experimental features. The report examines Cruciferra’s capabilities, its use in real-world campaigns, and its role as a growing malware-as-a-service platform linked to multiple malware families.
Indicators of Compromise (IOC) List
Domains/URLs | http://hsahyteiows.gu.cc http://yicoweytcbtw.gu.cc http://nciyeyrawoe.gu.cc http://lasiduutfe.gu.cc http://xkcifgieusr.gu.cc http://viuyeyrwqs.gu.cc http://pmcjsuyraw.gu.cc http://laiwutrencr.gu.cc http://maisytawe.gu.cc http://kawosyetw.gu.cc http://nviuawusye.gu.cc http://faeytrdeaw.gu.cc http://figyuyrqwr.gu.cc http://hfyuayustrv.gu.cc http://jsiruytrawey.gu.cc http://kawuuterta.gu.cc http://nvsieyrrawe.gu.cc http://fuaytrwese.love http://qeuasytua.love http://svuatwea.love http://vusuydryt.love http://xnbscuya.love http://ncduuyese.live https://oakwusya.love http://syfiaydytea.live http://jaiydteds.love http://mksfuuerwo.live http://fiusyevr.live http://lisiutegrm.live http://paiwudyea.love http://xuastyrdqk.love https://fvxcuvuyte.live https://kdsuyrse.live https://hsauyeet.live https://almacensantangel.com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar gatuso.duckdns.org https://digital-magicians.com/photo295825092412.zip?_r=ea623202 0zbqnac1t4dv2t2wuodv1m.com |
IP Address | 89.34.90.99 |
Hash | 3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e
66dbe675480dc229e5b3ab8ad74207f73486e64e57805074f784bb2e01bcb865
a6fb779be35592fb0ff624a8f8e12ab3cafe7bcfc312cd98263814db7fb01e02
59ad96dd3b4d5f10a5c53bbd465446e52dc7701a4ac633632f762bf1336d3347
6dbd6f9f2fa636c16ac4fa81418b68a604424861b9650dd9c4f2b0ba6f67d6ac
3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "http://kawuuterta.gu.cc" or url like "http://kawuuterta.gu.cc" or siteurl like "http://kawuuterta.gu.cc" or domainname like "http://svuatwea.love" or url like "http://svuatwea.love" or siteurl like "http://svuatwea.love" or domainname like "http://jaiydteds.love" or url like "http://jaiydteds.love" or siteurl like "http://jaiydteds.love" or domainname like "http://faeytrdeaw.gu.cc" or url like "http://faeytrdeaw.gu.cc" or siteurl like "http://faeytrdeaw.gu.cc" or domainname like "http://xuastyrdqk.love" or url like "http://xuastyrdqk.love" or siteurl like "http://xuastyrdqk.love" or domainname like "http://vusuydryt.love" or url like "http://vusuydryt.love" or siteurl like "http://vusuydryt.love" or domainname like "http://nvsieyrrawe.gu.cc" or url like "http://nvsieyrrawe.gu.cc" or siteurl like "http://nvsieyrrawe.gu.cc" or domainname like "http://jsiruytrawey.gu.cc" or url like "http://jsiruytrawey.gu.cc" or siteurl like "http://jsiruytrawey.gu.cc" or domainname like "http://fuaytrwese.love" or url like "http://fuaytrwese.love" or siteurl like "http://fuaytrwese.love" or domainname like "http://xkcifgieusr.gu.cc" or url like "http://xkcifgieusr.gu.cc" or siteurl like "http://xkcifgieusr.gu.cc" or domainname like "http://qeuasytua.love" or url like "http://qeuasytua.love" or siteurl like "http://qeuasytua.love" or domainname like "http://nciyeyrawoe.gu.cc" or url like "http://nciyeyrawoe.gu.cc" or siteurl like "http://nciyeyrawoe.gu.cc" or domainname like "http://syfiaydytea.live" or url like "http://syfiaydytea.live" or siteurl like "http://syfiaydytea.live" or domainname like "http://hsahyteiows.gu.cc" or url like "http://hsahyteiows.gu.cc" or siteurl like "http://hsahyteiows.gu.cc" or domainname like "http://laiwutrencr.gu.cc" or url like "http://laiwutrencr.gu.cc" or siteurl like "http://laiwutrencr.gu.cc" or domainname like "http://mksfuuerwo.live" or url like "http://mksfuuerwo.live" or siteurl like "http://mksfuuerwo.live" or domainname like "http://pmcjsuyraw.gu.cc" or url like "http://pmcjsuyraw.gu.cc" or siteurl like "http://pmcjsuyraw.gu.cc" or domainname like "http://ncduuyese.live" or url like "http://ncduuyese.live" or siteurl like "http://ncduuyese.live" or domainname like "http://hfyuayustrv.gu.cc" or url like "http://hfyuayustrv.gu.cc" or siteurl like "http://hfyuayustrv.gu.cc" or domainname like "http://lisiutegrm.live" or url like "http://lisiutegrm.live" or siteurl like "http://lisiutegrm.live" or domainname like "https://digital-magicians.com/photo295825092412.zip?_r=ea623202" or url like "https://digital-magicians.com/photo295825092412.zip?_r=ea623202" or siteurl like "https://digital-magicians.com/photo295825092412.zip?_r=ea623202" or domainname like "0zbqnac1t4dv2t2wuodv1m.com" or url like "0zbqnac1t4dv2t2wuodv1m.com" or siteurl like "0zbqnac1t4dv2t2wuodv1m.com" or domainname like "http://figyuyrqwr.gu.cc" or url like "http://figyuyrqwr.gu.cc" or siteurl like "http://figyuyrqwr.gu.cc" or domainname like "http://paiwudyea.love" or url like "http://paiwudyea.love" or siteurl like "http://paiwudyea.love" or domainname like "gatuso.duckdns.org" or url like "gatuso.duckdns.org" or siteurl like "gatuso.duckdns.org" or domainname like "http://nviuawusye.gu.cc" or url like "http://nviuawusye.gu.cc" or siteurl like "http://nviuawusye.gu.cc" or domainname like "http://kawosyetw.gu.cc" or url like "http://kawosyetw.gu.cc" or siteurl like "http://kawosyetw.gu.cc" or domainname like "http://fiusyevr.live" or url like "http://fiusyevr.live" or siteurl like "http://fiusyevr.live" or domainname like "https://fvxcuvuyte.live" or url like "https://fvxcuvuyte.live" or siteurl like "https://fvxcuvuyte.live" or domainname like "https://kdsuyrse.live" or url like "https://kdsuyrse.live" or siteurl like "https://kdsuyrse.live" or domainname like "https://hsauyeet.live" or url like "https://hsauyeet.live" or siteurl like "https://hsauyeet.live" or domainname like "http://lasiduutfe.gu.cc" or url like "http://lasiduutfe.gu.cc" or siteurl like "http://lasiduutfe.gu.cc" or domainname like "http://yicoweytcbtw.gu.cc" or url like "http://yicoweytcbtw.gu.cc" or siteurl like "http://yicoweytcbtw.gu.cc" or domainname like "http://maisytawe.gu.cc" or url like "http://maisytawe.gu.cc" or siteurl like "http://maisytawe.gu.cc" or domainname like "http://xnbscuya.love" or url like "http://xnbscuya.love" or siteurl like "http://xnbscuya.love" or domainname like "http://viuyeyrwqs.gu.cc" or url like "http://viuyeyrwqs.gu.cc" or siteurl like "http://viuyeyrwqs.gu.cc" or domainname like "https://oakwusya.love" or url like "https://oakwusya.love" or siteurl like "https://oakwusya.love" or domainname like "https://almacensantangel.com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar" or url like "https://almacensantangel.com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar" or siteurl like "https://almacensantangel.com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar" |
Detection Query 2 : | dstipaddress IN ("89.34.90.99") or srcipaddress IN ("89.34.90.99") |
Detection Query 3 : | sha256hash IN ("3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e","6dbd6f9f2fa636c16ac4fa81418b68a604424861b9650dd9c4f2b0ba6f67d6ac","3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d","a6fb779be35592fb0ff624a8f8e12ab3cafe7bcfc312cd98263814db7fb01e02","66dbe675480dc229e5b3ab8ad74207f73486e64e57805074f784bb2e01bcb865","59ad96dd3b4d5f10a5c53bbd465446e52dc7701a4ac633632f762bf1336d3347")
|
Reference:
https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service