crimsonrat | e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa | Triage

Sharing

General

Target

e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa
Size

53KB
MD5

3739bbf831d04e8a2b06275cd3af371d
SHA1

1bb0cb1be5227645c14b5757932df14b1b52c3cd
SHA256

e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa
SHA512

7aa6b6cc9cf36d847580553487b52ff446310a3b8ae605d93d42090dd35e056cbafb0cf95f2359e440c262f28707478b7152d72e647990c3a660757a90bd0099
SSDEEP

768:z+ZEIljcZQaM5pDg+lEqxTNsX8zLxUp3Xv9Uy9uK3W9:zmcZQaMPDgW3ocxUpHCy9uK3W9

Score

10^/10

crimsonrat

Malware Config

Signatures

CrimsonRAT Main Payload 1 IoCs

resource	yara_rule
sample	family_crimsonrat

Crimsonrat family
crimsonrat

Files

e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ