Static task
static1
Behavioral task
behavioral1
Sample
ignvdmvra.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ignvdmvra.exe
Resource
win10-en-20211208
General
-
Target
e903e54fed007ee14305bc21219b3fab69385e4df16714d737da5953f7f3c170
-
Size
60KB
-
MD5
a17d1de9caf6fbfa9828159e075085bf
-
SHA1
111699eedb188de219228eed7329774f11e4168e
-
SHA256
e903e54fed007ee14305bc21219b3fab69385e4df16714d737da5953f7f3c170
-
SHA512
db6358dc6ac4cf0b3d4229abd85bfc46ae1548b5234afb19b5d69ab79e3ba49581c59343c45ff3dc720bddc43677fd07782acc03194b47e18290afcf18b41ad6
-
SSDEEP
768:tcObBEPT8sff6ObU+//FRzAl1wr4v5vs/vv:tcO0T5PU+//XKdsHv
Malware Config
Signatures
-
CrimsonRAT Main Payload 1 IoCs
resource yara_rule static1/unpack001/ignvdmvra.exe family_crimsonrat -
Crimsonrat family
Files
-
e903e54fed007ee14305bc21219b3fab69385e4df16714d737da5953f7f3c170.zip
-
ignvdmvra.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 9.6MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ