Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
20 IOCs
Unpacking “Cruciferra”: An Analysis of a Sophisticated Crypter Service
Threat Actors
Malware Families
Excerpt
Key Findings Cruciferra is a sophisticated crypter service used by multiple unrelated cybercriminal threat clusters. It has been observed delivering a wide range of remote access trojans and infostealers. The malware employs extensive defense-evasion capabilities and over 90 variations of cryptographic functions to obfuscate its data and payloads. Proofpoint identified both production and apparent testing variants, indicating the service is under…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(6)
Victim
Indicators of Compromise
Open the mindmap →20 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | c5b1e9aafc8f2b4ab05effc00fd43f3114b9ef1d592a086c952793ac4e299809 | Medium | Score 53/100 | First seen |
| Domain | exploit.in | Low | Score 30/100 | First seen |
| SHA256 | 59ad96dd3b4d5f10a5c53bbd465446e52dc7701a4ac633632f762bf1336d3347 | Medium | Score 53/100 | First seen |
| SHA256 | 2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a | Medium | Score 53/100 | First seen |
| SHA256 | 17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc4 | Medium | Score 53/100 | First seen |
| SHA256 | 3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d | High | Score 85/100 | First seen |
| Domain | gatuso.duckdns.org | High | Score 58/100 | First seen |
| SHA256 | c46e907886e2158cbc453e767183aecf07887b5ac8848f19684451883d69f5f0 | Medium | Score 53/100 | First seen |
| SHA256 | 5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df | High | Score 56/100 | First seen |
| SHA256 | 09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1 | Medium | Score 53/100 | First seen |
| Domain | 0zbqnac1t4dv2t2wuodv1m.com | High | Score 69/100 | First seen |
| SHA256 | 66dbe675480dc229e5b3ab8ad74207f73486e64e57805074f784bb2e01bcb865 | Medium | Score 53/100 | First seen |
| SHA256 | a6fb779be35592fb0ff624a8f8e12ab3cafe7bcfc312cd98263814db7fb01e02 | Medium | Score 53/100 | First seen |
| SHA256 | c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c | Medium | Score 53/100 | First seen |
| SHA256 | 7887e919555fb5948c217556ba149392a72982b1bc427d3db779db9dcbf09ee8 | Medium | Score 53/100 | First seen |
| URL | https://digital-magicians.com/photo295825092412.zip?_r=ea623202 | High | Score 58/100 | First seen |
| SHA256 | 6dbd6f9f2fa636c16ac4fa81418b68a604424861b9650dd9c4f2b0ba6f67d6ac | Medium | Score 53/100 | First seen |
| IP | 89.34.90.99 | High | Score 86/100 | First seen |
| SHA256 | 3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e | Medium | Score 53/100 | First seen |
| URL | https://almacensantangel.com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…