CrackFix (Efimer loader/stealer)

Malware analysis · 2026-06-13 · progressive analysis; updating as time allows · Analyst: zzdh, ZBS Labs

Malware Info

Initial Access

ZBS Labs captured and analyzed a multi-stage malware package masquerading as a search utility binary (professional_ultrasearch_x3.bin). This sample was recovered after a user visited a website promising "cracked" software.

"Crack Code" lure

"CrackFix"

The sample is a Python-compiled PE64 executable.

Python package. Pull from the TEMP directory using this tool: https://github.com/zzdh-ZBS-Labs/ZBS_FGM_all_platforms

The directory(generated name) where the Javascript payload, hard-coded crypto wallets, and wordlist are. Pulled using this tool: https://github.com/zzdh-ZBS-Labs/ZBS_FGM_all_platforms

Upon execution, it creates numerous Defender exclusions.

Exclusions made for the directory the binary launched from

Exclusions for the directory that the payloads will be saved to

Exclusions for the TEMP directory where the python unpacks to

Excludes drives D, E, F, G and X, Y, Z

Excludes cmd.exe

It then deploys a multi-stage JScript payload that mainly operates over the Tor network using curl.exe.

Deobfuscated configs

Below, a tool was used to check the liveliness of each endpoint.

Tor endpoints are alive.

Persistence

This malware establishes persistence via scheduled tasks

Scheduled Task configurations.

At the time the sample was aquired, Virus Total listed 16 detections

VirusTotal

Anti-Analysis

The dropper performs a WMI query for taskmgr.exe before executing its primary routines

If Task Manager is detected, execution is suspended. With so many tools out there, this is a non-issue for any analyst.

Victim Fingerprinting

The malware derives a persistent victim identifier from the system's UUID:

The malware uses curl.exe to geolocate victims through ipinfo.io/country

Document Exfiltration

The malware enumerates Office documents (.doc, .xls, .xlsx, .xlsm).

Data is uploaded via curl over Tor SOCKS5.

The POST includes MGUID (victim ID) and path (filename) fields, giving the attacker a structured receive endpoint tag stolen files per victim.

USB/Network Worm — LNK Hijacking

The dropper polls for newly connected removable and fixed drives every 200ms. When a new drive is detected:

A lock file named <slug>_x4.exe is dropped to the drive root as an infection marker.

The drive's contents are moved into a hidden folder named after the volume label.

A .lnk shortcut file is created at the original folder path, mimicking the legitimate folder icon (shell32.dll,0).

The shortcut executes wscript.exe silently, pointing to the Stage 1 dropper with a /d flag — triggering a re-infection cycle on any new host that opens the USB drive.

Indicators