Static task
static1
Behavioral task
behavioral1
Sample
f23142e54092231ccc04960598d8d17f3a79a5bf0719a9a0cb73c588afae3808.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f23142e54092231ccc04960598d8d17f3a79a5bf0719a9a0cb73c588afae3808.exe
Resource
win10-en-20211208
General
-
Target
f23142e54092231ccc04960598d8d17f3a79a5bf0719a9a0cb73c588afae3808
-
Size
67KB
-
MD5
cb0768c89e83f2328952ba51e4d4b7f1
-
SHA1
dfff31642cddc28498df7e67682eef4a7647c61a
-
SHA256
f23142e54092231ccc04960598d8d17f3a79a5bf0719a9a0cb73c588afae3808
-
SHA512
ed9c6b632c5de10459b60e50bb7560788e38631fe72ed05b210b5f449beb8d3c290769c5e74c2c4fe245baf2b5eb0f6717fc74d41b17dc06a0b68d2e5aecf60d
-
SSDEEP
1536:p7MK+1p/FeD+6uATw4NLk50F9g+cLYmkdNgIWvUTIPwpawtbpXz6GqL1J9LBK9T:p5VIPy9TdYw5Ul
Malware Config
Signatures
-
CrimsonRAT Main Payload 1 IoCs
Processes:
resource yara_rule sample family_crimsonrat -
Crimsonrat family
Files
-
f23142e54092231ccc04960598d8d17f3a79a5bf0719a9a0cb73c588afae3808.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ