Static task
static1
Behavioral task
behavioral1
Sample
1cb8ca75dbc6c42d9f76281c7cc73333a146832f444f69c0ebf47ccb9bfdd010.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1cb8ca75dbc6c42d9f76281c7cc73333a146832f444f69c0ebf47ccb9bfdd010.exe
Resource
win10-en-20211208
General
-
Target
1cb8ca75dbc6c42d9f76281c7cc73333a146832f444f69c0ebf47ccb9bfdd010
-
Size
106KB
-
MD5
139a346c537ab91a38b438c82c8c219f
-
SHA1
880fa1a65d8c529753e64e4ed22d0e3622b9b030
-
SHA256
1cb8ca75dbc6c42d9f76281c7cc73333a146832f444f69c0ebf47ccb9bfdd010
-
SHA512
5143029646e058f6c85dc0b812d839227f3640540fa1469089ceea5cb5335175c289537722bf9f476cfcf86b422ca53e4b5a89e2602767be5c9908998c79add6
-
SSDEEP
1536:wS1EZqt60DY1KJsBlTYA9VylLOjOTggJF2xwtStzypT8fNDm9B76Z9H/xbdEtPY:wS1EZqt6bmpum9BGZ9fxbdJ
Malware Config
Signatures
-
CrimsonRAT Main Payload 1 IoCs
Processes:
resource yara_rule sample family_crimsonrat -
Crimsonrat family
Files
-
1cb8ca75dbc6c42d9f76281c7cc73333a146832f444f69c0ebf47ccb9bfdd010.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ