The Attack: Sophisticated Evasion Assumes the Payload Already Landed
Proofpoint recently documented Cruciferra, a crypter-as-a-service used by multiple cybercrime groups to deliver RATs and info-stealers to financial services, healthcare, government, and education targets. The campaigns use phishing emails with malicious attachments or links to ZIP files hosting the payload.
What makes Cruciferra interesting is the evasion stack: API unhooking, indirect system calls, BYOVD-based EDR (BYOVD: Bring Your Own Vulnerable Driver EDR: Endpoint Detection and Response) tampering using a vulnerable driver (GoFlyDrv.sys), UAC bypass via COM Elevation Moniker, registry persistence, and a customized implementation of Process Ghosting to execute the final payload while minimizing forensic artifacts.
Process Ghosting is particularly clever. The malware creates a temporary file, deletes it from disk before the process starts, then executes code from memory. Security tools that scan files on disk find nothing to scan. Cruciferra adds extra sophistication by patching ZwQueryVirtualMemory hooks and tampering with NtManageHotPatch to hide the deletion and neutralize integrity checks.
The entire evasion chain is designed to operate post-delivery. It assumes the payload is already on the system. That assumption is the vulnerability.
Why It Worked: Detection Happens After the Payload Lands
Cruciferra’s polymorphic encryption means each sample uses a dynamically generated algorithm derived from established cryptographic primitives. Signature-based detection fails. The crypter advertises itself as “the most lethal” for $450 to $2,000 a month specifically because it defeats static analysis and signature matching.
EDR tools that rely on behavioral detection see the payload after it’s already written to disk, after it’s already executed, after it’s already begun unhooking APIs and killing security processes via BYOVD. The race is lost before it starts.
The delivery vector is straightforward: phishing emails with attachments or links. The victim opens the attachment in Outlook or downloads the ZIP file via Chrome or Edge. At that moment, the email client or browser writes the malicious file to disk. That file operation is what starts everything else.
How FileSure Would Have Prevented It
FileSure Defend operates at the Windows kernel level via a filter driver. It intercepts file operations — open, read, write, delete, create, rename — before they complete. You define which programs are authorized to write which types of files to which locations. Everything else is blocked.
A simple rule stops Cruciferra at delivery:
File name filter: *.dll, *.exe, *.scr, *.bat, *.vbs, *.ps1
Program name filter: outlook.exe, chrome.exe, msedge.exe, firefox.exe (email clients and browsers)
Operations: Write, Create
Drive type: Hard drives
Result: Block and log
When the victim opens the phishing attachment or downloads the ZIP file, Outlook or Chrome attempts to write the DLL or executable payload to disk. FileSure intercepts that write operation at the kernel level and blocks it. The file never lands. The victim sees an access denied error. The attack stops.
Process Ghosting cannot ghost a file that was never written. BYOVD cannot tamper with security processes if the vulnerable driver was never installed. API unhooking is irrelevant if the payload never executed. The entire sophisticated evasion stack collapses because the first file write — the one that matters most — was denied.
The rule is simple. It runs on every Windows version from XP through Windows 11 and Server 2022. It works offline. It requires no signature updates. It stops Cruciferra variants that haven’t been seen yet the same way it stops known samples — because it controls file operations, not threat recognition.
FileSure doesn’t try to outsmart evasion techniques. It removes the assumption those techniques depend on: that the payload made it to disk in the first place.
Ready to stop malware at the delivery stage — before evasion techniques matter? Start a free 21-day trial at bystorm.com. Install it, send yourself a test file, and watch the block happen in real time. That’s the whole demo.
Source: Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
Category: Threat Intelligence
Tags: cruciferra, process ghosting, byovd, crypter, kernel filter driver, file system security, phishing malware, rat
