crimsonrat | feda78f1dff8bd9d850a154a627bcfb4041dc36c325be0db436ca85fe565f767

General

Target
feda78f1dff8bd9d850a154a627bcfb4041dc36c325be0db436ca85fe565f767
Size 1.9MB
Sample220121-2rn9babga4
SHA256 feda78f1dff8bd9d850a154a627bcfb4041dc36c325be0db436ca85fe565f767
MD5 f4273faff8df3c84c858be7f8aa8442e
SHA1 2b29180ee72426d8840ad26cc258c7d629e43275
SHA512 acbc6a0b5a2b9d94e7d72e8f8509b73114f186b22ab40a10c87988390cebdb3c23845dde22ae4d767020a8e8799e68d8b51ec9af0e2119a73a834f452de3aa5e
SSDEEP 24576:FHTVv92iaNO/H/m/S/m/S/m/K/m/0/m/S/m/S/m/T/m/S/m/S/m/T/m/j/t/:FHTVv92iaN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

crimsonrat

Malware Config

Signatures

CrimsonRAT Main Payload 1 IoCs

resource	yara_rule
sample	family_crimsonrat

Crimsonrat family
crimsonrat

File Explorer

feda78f1dff8bd9d850a154a627bcfb4041dc36c325be0db436ca85fe565f767

.exe 1.9MB

feda78f1dff8bd9d850a154a627bcfb4041dc36c325be0db436ca85fe565f767

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 feda78f1dff8bd9d850a154a627bcfb4041dc36c325be0db436ca85fe565f767
MD5 f4273faff8df3c84c858be7f8aa8442e
SHA1 2b29180ee72426d8840ad26cc258c7d629e43275
SHA512 acbc6a0b5a2b9d94e7d72e8f8509b73114f186b22ab40a10c87988390cebdb3c23845dde22ae4d767020a8e8799e68d8b51ec9af0e2119a73a834f452de3aa5e
SSDEEP 24576:FHTVv92iaNO/H/m/S/m/S/m/K/m/0/m/S/m/S/m/T/m/S/m/S/m/T/m/j/t/:FHTVv92iaN
MD5 SHA1 SHA512 SSDEEP

windows x86

CrimsonRAT Main Payload

Minor OS version

Major OS version

Entry point

1923758

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

feda78f1dff8bd9d850a154a627bcfb4041dc36c325be0db436ca85fe565f767

mscoree