Cruciferra加壳服务绕过防护投递多类RAT
摘要
2026年7月21日，Proofpoint披露名为Cruciferra的订阅制加壳服务在地下论坛售卖（最高约2000美元/月），自2025年秋季起活跃，被用于多起恶意投递活动以绕过Windows防护并削弱EDR检测。相关活动通过邮件诱饵、伪造税务门户、PDF链接、ZIP压缩包与虚拟硬盘文件等方式传播，涉及金融、医疗、政府、旅行与酒店等行业受害风险。Proofpoint在数十个活动中观察到该工具投递AsyncRAT、XWorm、zgRAT、Agent Tesla、Formbook、Remcos、XLoader等远控与信息窃取程序；其运行方式包含DLL侧加载、沙箱/虚拟机检测、移除监控钩子，并可采用BYOVD投放已签名的易受攻击驱动以终止安全进程。其载荷执行使用定制Process Ghosting，将载荷写入临时文件后标记删除并映射到内存，减少磁盘落地痕迹；部分与税务主题冒充机构的邮件及快捷方式触发PowerShell相关链路。文中还给出了多条与TA4922相关的Cruciferra投递URL、样本SHA-256、C2域名/IP及用于BYOVD的驱动文件哈希等IoC。
正文
## 事件背景 Cruciferra是一种犯罪服务，提供给恶意软件操作员绕过Windows防御的手段。该服务自2025年秋季以来活跃，主要在地下论坛上进行宣传，订阅费用高达每月2000美元。攻击者利用电子邮件诱饵、虚假税务门户、PDF链接、ZIP档案和虚拟硬盘文件进行传播，目标包括金融、医疗、政府、旅游和酒店等多个行业。 ## 攻击手法 Cruciferra通过将恶意程序包装成加密形式，使安全工具难以检测和阻止。该工具使用了多种技术，包括DLL侧加载、检查是否在沙箱中运行、隐藏控制台窗口、去除监控钩子等。它还可以通过带有漏洞的驱动程序进行攻击，发送低级命令终止安全进程。Cruciferra支持多种恶意软件，包括AsyncRAT、XWorm、zgRAT、Agent Tesla、Formbook、Remcos和XLoader。其加密机制使用超过90种加密例程，最终执行步骤采用定制的进程幽灵技术，使恶意程序在磁盘上不可见。 ## 影响评估 Cruciferra的出现使得恶意软件的检测变得更加困难，攻击者能够通过不断变化的代码隐藏不同的恶意软件家族，导致安全防护措施失效。此类攻击对金融、医疗和政府等关键行业造成了严重威胁，可能导致数据泄露和经济损失。 ## 处置建议 针对Cruciferra的应对措施包括阻止易受攻击的驱动程序，保持Windows和终端产品的更新，启用PowerShell日志记录，并仔细验证意外下载请求，特别是那些涉及紧急税务或投诉主题的请求。
标签
- group:银狐
- silverfox
- tag:Formbook
- tag:Negasteal
- tag:Remcos
- tag:XLoader
- tag:XWorm
- tag:zgRAT
- tag:异步RAT
- tag:银狐
- threatbook
- threat_intelligence
扩展字段
{
"attack_method": {
"attack_type": null,
"attck_count": 0,
"is_command": null,
"is_new_attack": null
},
"event_types": [],
"gpt_tags": [
"Negasteal",
"异步RAT",
"Remcos",
"Formbook",
"银狐",
"zgRAT",
"XLoader",
"XWorm"
],
"ioc": {
"domain": [
"sahyteiows.gu.cc",
"yicoweytcbtw.gu.cc",
"nciyeyrawoe.gu.cc",
"lasiduutfe.gu.cc",
"xkcifgieusr.gu.cc",
"viuyeyrwqs.gu.cc",
"pmcjsuyraw.gu.cc",
"laiwutrencr.gu.cc",
"maisytawe.gu.cc",
"kawosyetw.gu.cc",
"nviuawusye.gu.cc",
"faeytrdeaw.gu.cc",
"figyuyrqwr.gu.cc",
"hfyuayustrv.gu.cc",
"jsiruytrawey.gu.cc",
"kawuuterta.gu.cc",
"nvsieyrrawe.gu.cc",
"fuaytrwese.love",
"qeuasytua.love",
"svuatwea.love",
"vusuydryt.love",
"xnbscuya.love",
"ncduuyese.live",
"soakwusya.love",
"syfiaydytea.live",
"jaiydteds.love",
"mksfuuerwo.live",
"fiusyevr.live",
"lisiutegrm.live",
"paiwudyea.love",
"xuastyrdqk.love",
"sfvxcuvuyte.live",
"skdsuyrse.live",
"shsauyeet.live",
"almacensantangel.com",
"gatuso.duckdns.org",
"digital-magicians.com",
"0zbqnac1t4dv2t2wuodv1m.com",
"exploit.in"
],
"hash": [
"3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e",
"66dbe675480dc229e5b3ab8ad74207f73486e64e57805074f784bb2e01bcb865",
"a6fb779be35592fb0ff624a8f8e12ab3cafe7bcfc312cd98263814db7fb01e02",
"59ad96dd3b4d5f10a5c53bbd465446e52dc7701a4ac633632f762bf1336d3347",
"6dbd6f9f2fa636c16ac4fa81418b68a604424861b9650dd9c4f2b0ba6f67d6ac",
"3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d",
"17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc4",
"2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a",
"c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c",
"c5b1e9aafc8f2b4ab05effc00fd43f3114b9ef1d592a086c952793ac4e299809",
"7887e919555fb5948c217556ba149392a72982b1bc427d3db779db9dcbf09ee8",
"09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1",
"5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df",
"c46e907886e2158cbc453e767183aecf07887b5ac8848f19684451883d69f5f0"
],
"ioc": [
"89.34.90.99",
"3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e",
"66dbe675480dc229e5b3ab8ad74207f73486e64e57805074f784bb2e01bcb865",
"a6fb779be35592fb0ff624a8f8e12ab3cafe7bcfc312cd98263814db7fb01e02",
"59ad96dd3b4d5f10a5c53bbd465446e52dc7701a4ac633632f762bf1336d3347",
"6dbd6f9f2fa636c16ac4fa81418b68a604424861b9650dd9c4f2b0ba6f67d6ac",
"3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d",
"17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc4",
"2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a",
"c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c",
"c5b1e9aafc8f2b4ab05effc00fd43f3114b9ef1d592a086c952793ac4e299809",
"7887e919555fb5948c217556ba149392a72982b1bc427d3db779db9dcbf09ee8",
"09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1",
"5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df",
"c46e907886e2158cbc453e767183aecf07887b5ac8848f19684451883d69f5f0",
"sahyteiows.gu.cc",
"yicoweytcbtw.gu.cc",
"nciyeyrawoe.gu.cc",
"lasiduutfe.gu.cc",
"xkcifgieusr.gu.cc",
"viuyeyrwqs.gu.cc",
"pmcjsuyraw.gu.cc",
"laiwutrencr.gu.cc",
"maisytawe.gu.cc",
"kawosyetw.gu.cc",
"nviuawusye.gu.cc",
"faeytrdeaw.gu.cc",
"figyuyrqwr.gu.cc",
"hfyuayustrv.gu.cc",
"jsiruytrawey.gu.cc",
"kawuuterta.gu.cc",
"nvsieyrrawe.gu.cc",
"fuaytrwese.love",
"qeuasytua.love",
"svuatwea.love",
"vusuydryt.love",
"xnbscuya.love",
"ncduuyese.live",
"soakwusya.love",
"syfiaydytea.live",
"jaiydteds.love",
"mksfuuerwo.live",
"fiusyevr.live",
"lisiutegrm.live",
"paiwudyea.love",
"xuastyrdqk.love",
"sfvxcuvuyte.live",
"skdsuyrse.live",
"shsauyeet.live",
"almacensantangel.com",
"gatuso.duckdns.org",
"digital-magicians.com",
"0zbqnac1t4dv2t2wuodv1m.com",
"exploit.in"
],
"ip": [
"89.34.90.99"
]
},
"malware_name": [
"Tax-Number52563.zip",
"Tax-Number809863.zip",
"Tax-Number119863.zip",
"Tax-Number101863.zip",
"Tax-Number33863.zip",
"YourSSADocuments0000000676152051872026Document0000000676152.rar",
"photo295825092412.zip",
"Core64.sys",
"GoFlyDrv.sys",
"HwOs2Ec.sys",
"LnvMSRIO.sys",
"MemoryInformer.sys",
"NTIOLibX64.sys",
"ProcessMonitorDriver.sys",
"selfprot.sys"
],
"reference_links": [
"https://healsecurity.com/this-2000-a-month-crypter-can-kill-edr-and-make-malware-disappear-from-disk/"
],
"related_anonymous": "银狐",
"target_area": null,
"target_country": [],
"target_industry_type": [
"政府",
"国央企",
"民营、外资及其它行业",
"金融"
]
}