Static task
static1
Behavioral task
behavioral1
Sample
e05d31b46feaa752fda5fc43dffb22bf8be669e6e3aca3ad050e42f1984b0028.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e05d31b46feaa752fda5fc43dffb22bf8be669e6e3aca3ad050e42f1984b0028.exe
Resource
win10-en-20211208
General
-
Target
e05d31b46feaa752fda5fc43dffb22bf8be669e6e3aca3ad050e42f1984b0028
-
Size
9.6MB
-
MD5
c57defdc4133d27f9bc02a340ac35cd2
-
SHA1
026697c4993090507b9111d234670a1fc7680b14
-
SHA256
e05d31b46feaa752fda5fc43dffb22bf8be669e6e3aca3ad050e42f1984b0028
-
SHA512
68da8289337f6ca0ce786721b13cc525b356f37dd5569b5a1f57893d215fe8bec8911f8320e8a439dfc3b44cbcab43f3ddaab826eb827e70c287d8c2f52d5543
-
SSDEEP
384:MADvF/i0K+5vOZs7tuXpUshxMQc8mf73JcWwLdQxrNbSyskGFQsqyc6icxhzpBr:M8Lzvx7twpjMLV+Q7cLz
Malware Config
Signatures
-
CrimsonRAT Main Payload 1 IoCs
Processes:
resource yara_rule sample family_crimsonrat -
Crimsonrat family
Files
-
e05d31b46feaa752fda5fc43dffb22bf8be669e6e3aca3ad050e42f1984b0028.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 9.6MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ