Static task
static1
Behavioral task
behavioral1
Sample
c57089745a418cfb8cda224fa9faf383e72df19e5bd9e1cf83f7bfd4a5c819dc.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c57089745a418cfb8cda224fa9faf383e72df19e5bd9e1cf83f7bfd4a5c819dc.exe
Resource
win10-en-20211208
General
-
Target
c57089745a418cfb8cda224fa9faf383e72df19e5bd9e1cf83f7bfd4a5c819dc
-
Size
9.8MB
-
MD5
7db6c74d0eb170262538874c2358acd9
-
SHA1
fdbde78ce35a960705aa40e85f4667a5e04046dd
-
SHA256
c57089745a418cfb8cda224fa9faf383e72df19e5bd9e1cf83f7bfd4a5c819dc
-
SHA512
c7dee3a7b362ecc9ccb87029a0b747f954e9d3a64a5fa0883341a52f83b6d779e959d48517154a17b671484b570606b5951ba11daa54c82c059e1c08ee463b84
-
SSDEEP
3072:22Y4d6CB1eYQSHS29h5Q6e5d34EphsnjiKksDyS4VUyn0fI2BAgUhvw2QUGQoDB:7Y4GmaPAjiKksDyStyLgRUGdDBa
Malware Config
Signatures
-
CrimsonRAT Main Payload 1 IoCs
Processes:
resource yara_rule sample family_crimsonrat -
Crimsonrat family
Files
-
c57089745a418cfb8cda224fa9faf383e72df19e5bd9e1cf83f7bfd4a5c819dc.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 9.5MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 371KB - Virtual size: 371KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ