crimsonrat | 06158ea9684f86faee3e0d09810f78f1c9be304f92a9d13cf908995dec12741c | Triage

Sharing

General

Target

06158ea9684f86faee3e0d09810f78f1c9be304f92a9d13cf908995dec12741c
Size

88KB
MD5

5371d2984cbd1ae8283f9ae9eeee718d
SHA1

7ddd331686d6b26dc779645a51c7f7eabb655a74
SHA256

06158ea9684f86faee3e0d09810f78f1c9be304f92a9d13cf908995dec12741c
SHA512

18bddf4ab2338f414c13273c588a55c7e6861a6debca8e4540e82e050204e9aff6a137cf997e2131c6f716d82ebabaa24bedcb5489640209d603c944a2d65450
SSDEEP

768:4lolRcK9qjuNJGwT+Shiksha2MrAzV0cm79RFXsaHJPxEj5zfgaMsPHhr:4lscZurGWf7pozTm79RiUlxEj5z3M

Score

10^/10

crimsonrat

Malware Config

Signatures

CrimsonRAT Main Payload 1 IoCs

resource	yara_rule
sample	family_crimsonrat

Crimsonrat family
crimsonrat

Files

06158ea9684f86faee3e0d09810f78f1c9be304f92a9d13cf908995dec12741c
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ