Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

Proofpoint analysis describes Cruciferra, a sophisticated Mono-based crypter sold on criminal forums and used by multiple China-linked cybercrime clusters to obfuscate and deliver RATs and information stealers (e.g., Agent Tesla, AsyncRAT, XLoader) via phishing campaigns targeting finance, healthcare, government, education, and manufacturing. The service employs DLL side-loading, polymorphic payload encryption, BYOVD driver abuse (GoFlyDrv.sys), UAC bypass via the COM Elevation Moniker, persistence via the Run registry key ('putty'), and a customized Process Ghosting implementation to minimize forensic artifacts.