{
  "name": "Unpacking \"Cruciferra\": An Analysis of a Sophisticated Crypter Service",
  "slug": "unpacking-cruciferra-an-analysis-of-a-sophisticated-crypter-service",
  "description": "Cruciferra is a sophisticated crypter service utilized by multiple unrelated cybercriminal threat clusters to deliver remote access trojans and infostealers. Written in Mono, it employs extensive defense-evasion capabilities including indirect system calls, API unhooking, BYOVD-based EDR tampering, privilege escalation, and customized Process Ghosting for payload execution. The service features over 90 variations of cryptographic functions to obfuscate data and payloads, complicating static analysis and signature-based detection. Cruciferra was first advertised in fall 2025 with pricing tiers ranging from $450 to $2000 monthly. It has been observed in campaigns delivering various malware families including zgRAT, AgentTesla, AsyncRAT, XLoader, XWorm, Phantom Stealer, Formbook, and Remcos, primarily targeting financial services, healthcare, and government entities through opportunistic email-based attacks.",
  "published": "2026-07-20T09:36:09.037000+00:00",
  "created_at": "2026-07-20T11:16:28.354000+00:00",
  "modified_at": null,
  "created_at_opencti": null,
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "adaptixc2",
    "agenttesla",
    "asyncrat",
    "byovd",
    "cruciferra",
    "crypter-service",
    "darkcloud stealer",
    "dcrat",
    "defense-evasion",
    "dll-sideloading",
    "edr-tampering",
    "formbook",
    "malware-as-a-service",
    "phantom stealer",
    "process-ghosting",
    "remcos",
    "snake keylogger",
    "valleyrat",
    "winos4.0",
    "xloader",
    "xworm",
    "zgrat"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "54d068c7-0abf-497d-bf9f-4bebd7892972",
        "name": "http://figyuyrqwr.gu.cc"
      },
      {
        "id": "8925bead-8a31-4862-8440-7e1d519b4255",
        "name": "http://yicoweytcbtw.gu.cc"
      },
      {
        "id": "01c7f30b-88a5-4d0b-915d-0d788a6f6406",
        "name": "a6fb779be35592fb0ff624a8f8e12ab3cafe7bcfc312cd98263814db7fb01e02"
      },
      {
        "id": "e447abf4-69ab-4b52-90ae-c78f27258cdf",
        "name": "ncduuyese.live"
      },
      {
        "id": "b92a3979-a376-4445-92ff-4e44df8fd476",
        "name": "http://xkcifgieusr.gu.cc"
      },
      {
        "id": "f64e71bc-884c-4a41-a86e-683c1aa8f42b",
        "name": "lisiutegrm.live"
      },
      {
        "id": "b71d27a4-7a60-4dec-b72d-66270f4cc1b1",
        "name": "http://lasiduutfe.gu.cc"
      },
      {
        "id": "6f3d65df-5e99-4938-b6a8-dd2ddb5623dd",
        "name": "gatuso.duckdns.org"
      },
      {
        "id": "8b5701f5-4894-4280-a1e3-27e9a096fbc9",
        "name": "http://hfyuayustrv.gu.cc"
      },
      {
        "id": "f12f92a1-f474-4ced-a0cc-15309c1e5528",
        "name": "2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a"
      },
      {
        "id": "396e1228-650a-43e5-8c78-729d156ff299",
        "name": "digital-magicians.com"
      },
      {
        "id": "40bd5250-bdc2-4221-be13-89b02c6b5b35",
        "name": "http://faeytrdeaw.gu.cc"
      },
      {
        "id": "d8c5651e-a0c5-4f1e-b135-f672977fa929",
        "name": "09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1"
      },
      {
        "id": "943e1608-7a13-4328-9e4b-bfabd7ae68cf",
        "name": "paiwudyea.love"
      },
      {
        "id": "642dcc69-69b1-4424-8984-c28f8b8cddb7",
        "name": "http://laiwutrencr.gu.cc"
      },
      {
        "id": "a6626668-8b7c-4177-a677-15ccc2f3dbc7",
        "name": "http://qeuasytua.love"
      },
      {
        "id": "6bb07ab3-b81b-46de-8dab-e94e17472690",
        "name": "http://hsahyteiows.gu.cc"
      },
      {
        "id": "e53f5e32-f6af-420f-90a3-3af2b0841afa",
        "name": "http://xnbscuya.love"
      },
      {
        "id": "257d8490-467f-45a6-9909-bdc7a426dc8d",
        "name": "fiusyevr.live"
      },
      {
        "id": "26b1477c-7150-4316-ba31-06cb5976925e",
        "name": "xnbscuya.love"
      },
      {
        "id": "aa6c2275-c8da-453b-81a5-953edf5619a9",
        "name": "https://almacensantangel.com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar"
      },
      {
        "id": "27f44f2b-06a2-4f80-a535-505399a744b2",
        "name": "6dbd6f9f2fa636c16ac4fa81418b68a604424861b9650dd9c4f2b0ba6f67d6ac"
      },
      {
        "id": "445acac9-e2d0-4c0e-8b01-b945f9b458c9",
        "name": "https://fvxcuvuyte.live"
      },
      {
        "id": "13268d71-7e50-4a1d-92d6-5d47d8173b68",
        "name": "http://jaiydteds.love"
      },
      {
        "id": "d9274254-2b89-4a28-914b-59f7da795bc4",
        "name": "http://syfiaydytea.live"
      },
      {
        "id": "f049002e-cec5-4a19-871e-a270e8bc980f",
        "name": "http://nvsieyrrawe.gu.cc"
      },
      {
        "id": "7f83512d-0bd3-4426-b415-f40c83d94b6a",
        "name": "c46e907886e2158cbc453e767183aecf07887b5ac8848f19684451883d69f5f0"
      },
      {
        "id": "dd4ceef7-14e9-4007-901e-941533ab2674",
        "name": "0zbqnac1t4dv2t2wuodv1m.com"
      },
      {
        "id": "54eca0c4-854f-4e14-b390-b386b9ca1b3a",
        "name": "66dbe675480dc229e5b3ab8ad74207f73486e64e57805074f784bb2e01bcb865"
      },
      {
        "id": "e7a30415-2491-4c7e-ac90-38ce6090bb7c",
        "name": "qeuasytua.love"
      },
      {
        "id": "866c3231-5a98-4f2e-bdc7-029c419f0ce3",
        "name": "kdsuyrse.live"
      },
      {
        "id": "87747652-60a4-4ac0-ba1c-bd866bd4df48",
        "name": "http://fuaytrwese.love"
      },
      {
        "id": "1168d126-9ba0-4a28-92ed-1520251773bd",
        "name": "http://nciyeyrawoe.gu.cc"
      },
      {
        "id": "66976ded-fc77-43d8-86d1-00a790adbabf",
        "name": "3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e"
      },
      {
        "id": "aafb7690-3c12-498a-9d35-26f3b6f14390",
        "name": "vusuydryt.love"
      },
      {
        "id": "796c3253-2c9a-4968-a35a-8bd791c56c37",
        "name": "http://vusuydryt.love"
      },
      {
        "id": "73a4c66f-bac3-4acc-b194-68b35dc2e761",
        "name": "http://kawuuterta.gu.cc"
      },
      {
        "id": "87996e83-7ea6-4376-9588-101adc0ea411",
        "name": "http://jsiruytrawey.gu.cc"
      },
      {
        "id": "050559f4-445c-42fb-9ab7-cdbf86487275",
        "name": "17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc4"
      },
      {
        "id": "db9dff97-fa90-46f9-a8f6-31f2ca0a2328",
        "name": "https://oakwusya.love"
      },
      {
        "id": "9939bf6d-3cac-4a29-bd6e-05890b7debd6",
        "name": "http://paiwudyea.love"
      },
      {
        "id": "0d699b39-2fb2-4f92-89d2-a81b870a1511",
        "name": "fvxcuvuyte.live"
      },
      {
        "id": "727b133f-ffa6-43fa-a40f-7de28847301a",
        "name": "https://digital-magicians.com/photo295825092412.zip?_r=ea623202"
      },
      {
        "id": "d5a1f383-71c2-412d-877c-584e6660ecd0",
        "name": "fuaytrwese.love"
      },
      {
        "id": "d3a44496-a41a-4962-9fe1-0dd9e5620403",
        "name": "http://maisytawe.gu.cc"
      },
      {
        "id": "890a6c63-cda0-4f6b-8c53-e2e8291fdc05",
        "name": "http://xuastyrdqk.love"
      },
      {
        "id": "63d255f5-e4a7-41d1-b6d2-b65e51911398",
        "name": "3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d"
      },
      {
        "id": "3131c4c3-1bee-45e6-92dd-80a1f9784a73",
        "name": "hsauyeet.live"
      },
      {
        "id": "08ba3703-9d55-4b8e-a401-fc770113f9a8",
        "name": "89.34.90.99"
      },
      {
        "id": "3a9adcc6-f61d-4f5e-a35e-f039bc123fcd",
        "name": "http://nviuawusye.gu.cc"
      },
      {
        "id": "66834a4e-b034-4020-b353-0e3a2b9bbf79",
        "name": "http://fiusyevr.live"
      },
      {
        "id": "01d339c9-0544-46bc-ade4-e6964b355e51",
        "name": "c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c"
      },
      {
        "id": "ca77ce1a-b6f2-49b6-8881-9ecca5a69c95",
        "name": "mksfuuerwo.live"
      },
      {
        "id": "82d718b1-4419-4502-b655-58bee2e348b2",
        "name": "5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df"
      },
      {
        "id": "baad2119-a087-4a75-b980-8b7e5222c595",
        "name": "http://lisiutegrm.live"
      },
      {
        "id": "b0196855-d193-4da5-9a7b-34d134044d12",
        "name": "xuastyrdqk.love"
      },
      {
        "id": "d197acbf-dfbd-4cc8-a1fe-ddc6f62aad27",
        "name": "http://mksfuuerwo.live"
      },
      {
        "id": "49fd20aa-5b39-4792-8696-e7cad5729aa4",
        "name": "http://kawosyetw.gu.cc"
      },
      {
        "id": "7f429fb7-42d8-48af-9f82-8d083649f228",
        "name": "oakwusya.love"
      },
      {
        "id": "8c2ead75-d517-4bc8-84d7-95bfc5bf9e5c",
        "name": "http://svuatwea.love"
      },
      {
        "id": "87fc06a4-68fd-4f9d-a10c-195758a460ff",
        "name": "http://pmcjsuyraw.gu.cc"
      },
      {
        "id": "5d007e5c-583d-469f-9859-1fe13d61e10a",
        "name": "syfiaydytea.live"
      },
      {
        "id": "796ef776-e97c-4472-94ed-cc8747edd16a",
        "name": "jaiydteds.love"
      },
      {
        "id": "b42231cb-92da-4847-a0b1-0a559e34641a",
        "name": "https://kdsuyrse.live"
      },
      {
        "id": "01291099-5154-4e6b-b221-d87c9019dc55",
        "name": "http://viuyeyrwqs.gu.cc"
      },
      {
        "id": "d3416c42-fe59-43e2-bb62-350bd36d1d44",
        "name": "almacensantangel.com"
      },
      {
        "id": "031e4122-e6c5-428d-b5bb-5ced91510069",
        "name": "7887e919555fb5948c217556ba149392a72982b1bc427d3db779db9dcbf09ee8"
      },
      {
        "id": "0911888c-4e4a-40db-8812-7843c946c07e",
        "name": "https://hsauyeet.live"
      },
      {
        "id": "38f7a140-dce7-4fce-880b-31d2a456f99d",
        "name": "c5b1e9aafc8f2b4ab05effc00fd43f3114b9ef1d592a086c952793ac4e299809"
      },
      {
        "id": "34bf48ce-f787-41b0-9538-9a463cd9fea5",
        "name": "http://ncduuyese.live"
      },
      {
        "id": "a1965dc7-f813-43ae-95e9-ba2853b697f2",
        "name": "svuatwea.love"
      },
      {
        "id": "67a3bff4-db00-40d3-995d-e2b17f3b90d8",
        "name": "59ad96dd3b4d5f10a5c53bbd465446e52dc7701a4ac633632f762bf1336d3347"
      }
    ],
    "intrusion_sets": [
      {
        "id": "75f73d42-b028-4b74-9c87-cdfbdedbdfd0",
        "name": "TA4922",
        "slug": "ta4922"
      }
    ],
    "attack_patterns": [
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7dc1bc79-ccad-419e-b7c0-0f7fa8522270",
        "name": "T1055.012"
      },
      {
        "id": "d048ac4b-dd28-4c66-b62b-fe25cefef481",
        "name": "T1548.002"
      },
      {
        "id": "41af8283-2fa5-469e-9c29-e8ad77b4f224",
        "name": "T1014"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "14da8ebf-e0b0-4d4e-9c83-56277980f266",
        "name": "T1134"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "dea4e00b-6e38-4223-a0f2-8a44e403019b",
        "name": "T1564.003"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "423b30c9-2ee8-4ca1-9338-568d3f65adb5",
        "name": "T1055.013"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "a7262c61-4567-4a00-8cec-aae6264234a9",
        "name": "T1218"
      }
    ],
    "malware": [
      {
        "id": "6e24d6d5-190d-4425-a63d-51ec0f89528d",
        "name": "AdaptixC2",
        "slug": "adaptixc2"
      },
      {
        "id": "17695d4d-10e5-4495-be55-b1adfcc8a749",
        "name": "Winos4.0",
        "slug": "winos40"
      },
      {
        "id": "c7a2ae10-c0a1-4d4b-b2f2-d841d95ea5d2",
        "name": "DarkCloud Stealer",
        "slug": "darkcloud-stealer"
      },
      {
        "id": "920de979-aa97-486e-bb79-270dffb6d6ba",
        "name": "Snake Keylogger",
        "slug": "snake-keylogger"
      },
      {
        "id": "108651da-083f-4bf0-be99-1b3f28f3967e",
        "name": "AgentTesla",
        "slug": "agenttesla"
      },
      {
        "id": "f8879be0-dea7-4e8d-9aba-78c8ac8c6207",
        "name": "ValleyRAT",
        "slug": "valleyrat"
      },
      {
        "id": "4e77126c-0e46-4d28-9c7b-eb4c1fe8f7bb",
        "name": "Formbook",
        "slug": "formbook"
      },
      {
        "id": "1df1d083-ee25-4425-a621-f717f64e559d",
        "name": "Phantom Stealer",
        "slug": "phantom-stealer"
      },
      {
        "id": "82e2ea8e-729a-4648-ba23-3a792f53fa15",
        "name": "XWorm",
        "slug": "xworm"
      },
      {
        "id": "f200fb60-5446-493f-9712-9f26d65956cc",
        "name": "AsyncRAT",
        "slug": "asyncrat"
      },
      {
        "id": "ea762013-7e5e-4c6f-b94e-3efe41b24468",
        "name": "Cruciferra"
      },
      {
        "id": "eb832bdd-0dcb-4866-8f63-4dd299798562",
        "name": "DCRAT",
        "slug": "dcrat"
      },
      {
        "id": "122bf779-4f3d-40f8-952a-3b8830283668",
        "name": "zgRAT",
        "slug": "zgrat"
      },
      {
        "id": "29d292f7-f50d-4c23-900d-035ab7488290",
        "name": "Remcos",
        "slug": "remcos"
      }
    ],
    "observables": [
      {
        "id": "c4702b95-000a-47f1-80e8-9e0bcfc8dcb9",
        "name": "vusuydryt.love"
      },
      {
        "id": "25274779-5765-4a01-8f79-12309dc65f5e",
        "name": "qeuasytua.love"
      },
      {
        "id": "bf3425f5-ac82-4cf8-91b4-7bf64be9b44e",
        "name": "kdsuyrse.live"
      },
      {
        "id": "d05a69ea-9a09-4716-a021-6ac6f33fb2ae",
        "name": "0zbqnac1t4dv2t2wuodv1m.com"
      },
      {
        "id": "d8492b27-99f7-4f34-a434-287331e19333",
        "name": "xuastyrdqk.love"
      },
      {
        "id": "7c573ecb-fc07-403b-b061-63f34963a7b8",
        "name": "lisiutegrm.live"
      },
      {
        "id": "bdf10885-1ef6-4f6e-8e67-9c9470739f32",
        "name": "fiusyevr.live"
      },
      {
        "id": "cbe1ac2f-6bd6-4ec8-bc8b-34d9806168ac",
        "name": "mksfuuerwo.live"
      },
      {
        "id": "b9ab0e1c-f282-4118-9c2a-512c50711729",
        "name": "paiwudyea.love"
      },
      {
        "id": "353311b7-909c-4674-bf0d-05a0dad9d7d8",
        "name": "ncduuyese.live"
      },
      {
        "id": "ca8ab605-c91d-43f9-b3ad-dafc2cdf5dfd",
        "name": "oakwusya.love"
      },
      {
        "id": "f396c5c5-c4d9-42c3-b53d-4c654594eb85",
        "name": "jaiydteds.love"
      },
      {
        "id": "2352b31f-a960-4972-a7a9-cbf9be336294",
        "name": "syfiaydytea.live"
      },
      {
        "id": "2e24b7cc-d65e-4354-a76c-9648c25e7f0c",
        "name": "digital-magicians.com"
      },
      {
        "id": "7e7ff067-5ca0-4ff0-ba9c-07dbd16f5ba9",
        "name": "svuatwea.love"
      },
      {
        "id": "1f3e2da8-6c7b-43ca-a3e8-41205a9e2fde",
        "name": "fuaytrwese.love"
      },
      {
        "id": "d3f014ad-1ed9-43b4-a39d-18803758acfa",
        "name": "almacensantangel.com"
      },
      {
        "id": "139d9daa-c953-45e4-891e-415190aace32",
        "name": "fvxcuvuyte.live"
      },
      {
        "id": "f30047c2-1b41-4a93-b1f5-9e19f874bce1",
        "name": "hsauyeet.live"
      },
      {
        "id": "dfcd1758-7f30-4a52-95ad-64228413cee1",
        "name": "xnbscuya.love"
      },
      {
        "id": "567efd92-08bb-47e6-9637-5866f2c9a236",
        "name": "gatuso.duckdns.org"
      },
      {
        "id": "922d168e-47bb-4760-837c-750ebe3dc5db",
        "name": "89.34.90.99"
      },
      {
        "id": "1d2257a1-9dd3-47c0-953b-f08c6389c0fb",
        "name": "http://mksfuuerwo.live"
      },
      {
        "id": "b30c44da-cb8a-4dff-9b19-c6fc1f41add7",
        "name": "http://qeuasytua.love"
      },
      {
        "id": "da2bc01a-6904-4031-a270-83d546f852c2",
        "name": "https://hsauyeet.live"
      },
      {
        "id": "151b8e58-a278-4f39-b81f-6ea5c8ceb805",
        "name": "http://maisytawe.gu.cc"
      },
      {
        "id": "866f4fed-d3b6-4c87-852d-6caaedd953c1",
        "name": "http://ncduuyese.live"
      },
      {
        "id": "37400b0a-620f-49c8-a8e1-455eb879531e",
        "name": "http://nvsieyrrawe.gu.cc"
      },
      {
        "id": "d89f6f6a-3318-48ea-9631-a031ca600ce0",
        "name": "http://viuyeyrwqs.gu.cc"
      },
      {
        "id": "c0e57a66-103e-44c3-9e81-1efa543e6dcc",
        "name": "https://fvxcuvuyte.live"
      },
      {
        "id": "739dc481-d99e-4913-af68-8c583762bda5",
        "name": "http://nviuawusye.gu.cc"
      },
      {
        "id": "eb20ebfd-cdde-40b2-aeaa-bcb29e3abc0a",
        "name": "http://svuatwea.love"
      },
      {
        "id": "cbcee86c-1d70-406f-9413-b2f809e28a78",
        "name": "http://hsahyteiows.gu.cc"
      },
      {
        "id": "2b53e57a-93c5-48f5-b131-b99ae6fb53ce",
        "name": "http://lasiduutfe.gu.cc"
      },
      {
        "id": "8981ee9f-443a-457c-8b3e-35c388d654da",
        "name": "http://syfiaydytea.live"
      },
      {
        "id": "d4181ec8-2677-4119-a9de-4972e116555e",
        "name": "http://nciyeyrawoe.gu.cc"
      },
      {
        "id": "9abfce0b-5082-4ece-9818-9a3de87e02e1",
        "name": "http://jsiruytrawey.gu.cc"
      },
      {
        "id": "1d322840-873b-4030-9219-30e9b823fb0b",
        "name": "http://kawosyetw.gu.cc"
      },
      {
        "id": "f75783a4-bb3d-4d23-8d8c-7d295b82ad6a",
        "name": "http://faeytrdeaw.gu.cc"
      },
      {
        "id": "77144f40-3f98-4de6-867a-ce041512002a",
        "name": "http://laiwutrencr.gu.cc"
      },
      {
        "id": "28d72df1-c9c6-4f2b-a039-282171c3b892",
        "name": "http://jaiydteds.love"
      },
      {
        "id": "ed208e8f-d488-46c7-b725-fb4846268f13",
        "name": "https://oakwusya.love"
      },
      {
        "id": "b7bd33d1-e7b2-49e7-b890-81673e6be910",
        "name": "https://almacensantangel.com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar"
      },
      {
        "id": "90477095-1f95-4ae6-9fa7-041816a7c7d9",
        "name": "http://xnbscuya.love"
      },
      {
        "id": "842eb27a-792a-46d2-8870-1ed74aff5846",
        "name": "http://fuaytrwese.love"
      },
      {
        "id": "2f44ed47-f5a2-488f-8afe-f0e1cfa8c3b6",
        "name": "http://fiusyevr.live"
      },
      {
        "id": "3ab21ce6-3e29-49f5-a19a-4930b5377368",
        "name": "http://yicoweytcbtw.gu.cc"
      },
      {
        "id": "a8d45e2c-f122-4ddf-88a5-c95e49ed9941",
        "name": "http://figyuyrqwr.gu.cc"
      },
      {
        "id": "9c2f0655-ceb3-4559-adb7-2ccd3be8315c",
        "name": "http://pmcjsuyraw.gu.cc"
      },
      {
        "id": "67d28853-4976-450c-8e09-ba905fdd0728",
        "name": "https://kdsuyrse.live"
      },
      {
        "id": "bde2e5ec-38d7-4c96-ab43-49d3585ecb9c",
        "name": "http://lisiutegrm.live"
      },
      {
        "id": "f0dd8ccd-093f-4102-9281-055f428435e1",
        "name": "http://paiwudyea.love"
      },
      {
        "id": "037388ca-70ca-4b64-9d3b-cb29b9d1a191",
        "name": "http://hfyuayustrv.gu.cc"
      },
      {
        "id": "3f31e3c0-5ed2-440b-94a3-c6448e76d643",
        "name": "http://vusuydryt.love"
      },
      {
        "id": "3eec9459-a201-409a-bf04-3caf5134a7f7",
        "name": "http://xuastyrdqk.love"
      },
      {
        "id": "06e773f6-0d9c-4362-aba7-1618e353c276",
        "name": "http://xkcifgieusr.gu.cc"
      },
      {
        "id": "320fad83-3058-4581-9cde-419014b3eb7f",
        "name": "http://kawuuterta.gu.cc"
      },
      {
        "id": "566116f2-0714-480e-8e94-431a0973cb17",
        "name": "https://digital-magicians.com/photo295825092412.zip?_r=ea623202"
      }
    ]
  },
  "external_refs": [
    {
      "id": "d8ca1935-b978-4beb-9035-d9c91f10cd1c",
      "standard_id": "external-reference--c174ec86-4903-5c5f-80b9-7486ab2ab052",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a5dec09c0c4b7d2a00d7b2c",
      "hash": null,
      "external_id": "6a5dec09c0c4b7d2a00d7b2c",
      "created": "2026-07-20T11:16:20.928Z",
      "modified": "2026-07-20T11:16:20.928Z",
      "createdById": null
    },
    {
      "id": "844f5f41-f979-4707-8010-d8f593fc64db",
      "standard_id": "external-reference--e876a390-4511-5347-b8b6-b802f6a9ff19",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service",
      "hash": null,
      "external_id": null,
      "created": "2026-07-20T11:16:21.044Z",
      "modified": "2026-07-20T11:16:21.044Z",
      "createdById": null
    }
  ]
}