Static task
static1
Behavioral task
behavioral1
Sample
e0e33f6a80bd4bab7ea7b21d64e2632d9d769aa8994ece8fae9fc358b85514d5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e0e33f6a80bd4bab7ea7b21d64e2632d9d769aa8994ece8fae9fc358b85514d5.exe
Resource
win10-en-20211208
General
-
Target
e0e33f6a80bd4bab7ea7b21d64e2632d9d769aa8994ece8fae9fc358b85514d5
-
Size
9.6MB
-
MD5
7f2cd620a7ab73508962856bdcfe2866
-
SHA1
f926516893416256482514ba8e28ae9ff1de86aa
-
SHA256
e0e33f6a80bd4bab7ea7b21d64e2632d9d769aa8994ece8fae9fc358b85514d5
-
SHA512
58009457cf4ef94f1cf8b6e2ae95e8e838928af195234112ac01e9a2f64b5f074c5590db53b21c2b9ed7ab2bd316619a400326d5409bb27f869ad70d89fff4d3
-
SSDEEP
384:+keYLZqxvDxFs3ISzIDovRwMfoL4Xg5d1WFdrJd/dcvk5rVVAsMLZClHlHLTbGk:TNwxvDcJRg5WPnKgzpQ+rTbr9vJmz
Malware Config
Signatures
-
CrimsonRAT Main Payload 1 IoCs
resource yara_rule sample family_crimsonrat -
Crimsonrat family
Files
-
e0e33f6a80bd4bab7ea7b21d64e2632d9d769aa8994ece8fae9fc358b85514d5.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 9.6MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ