crimsonrat | 3ce8cba4a3271721f7e2f5cab90aff56a4a6d2364d5ecbf789aa951fae7c4572

General

Target
3ce8cba4a3271721f7e2f5cab90aff56a4a6d2364d5ecbf789aa951fae7c4572
Size 57KB
Sample220130-srns4sdge8
SHA256 3ce8cba4a3271721f7e2f5cab90aff56a4a6d2364d5ecbf789aa951fae7c4572
MD5 51af2cdd17a8af028db8a0a2909018f3
SHA1 2ab41eeea92f6dfac5fb8508d83c173ef903117e
SHA512 adb8ef42d12d3d2d7b85102b4344757c9479c2f761dcbb7698306fe0b8b1145629716ab14fcdfd8fcc15006a1f3420a101bc041df2a16e18b42217b8a50b26d9
SSDEEP 768:HYb4Yj7unS4gcawlPIWueWkn5UoWuVyXb:4b4MWSoYvu5JW/L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

crimsonrat

Malware Config

Signatures

CrimsonRAT Main Payload 1 IoCs

resource	yara_rule
static1/unpack001/rwlbmarivs.exe	family_crimsonrat

Crimsonrat family
crimsonrat

File Explorer

3ce8cba4a3271721f7e2f5cab90aff56a4a6d2364d5ecbf789aa951fae7c4572

.zip 57KB
rwlbmarivs.exe

.exe 9.6MB

3ce8cba4a3271721f7e2f5cab90aff56a4a6d2364d5ecbf789aa951fae7c4572

SHA256 3ce8cba4a3271721f7e2f5cab90aff56a4a6d2364d5ecbf789aa951fae7c4572
MD5 51af2cdd17a8af028db8a0a2909018f3
SHA1 2ab41eeea92f6dfac5fb8508d83c173ef903117e
SHA512 adb8ef42d12d3d2d7b85102b4344757c9479c2f761dcbb7698306fe0b8b1145629716ab14fcdfd8fcc15006a1f3420a101bc041df2a16e18b42217b8a50b26d9
SSDEEP 768:HYb4Yj7unS4gcawlPIWueWkn5UoWuVyXb:4b4MWSoYvu5JW/L
MD5 SHA1 SHA512 SSDEEP

rwlbmarivs.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 56331a4bc845b9ce0f2ad37f9c28d7c629e629d51349db0e5c5859b189c04ba1
MD5 6330ad6d358ef2985a0c630cc5e0b9f0
SHA1 6a13b5b42e6967e88a80584ab8e894b03c1baac7
SHA512 f85255da480164b3b60593c9ef9f274e5aa02146b2f26285c06639520de031be5f9572616d82e623a849c8cd7b6d74b399b237cad9bef7032d6928c4a945e72e
SSDEEP 384:2nMUpKR4h6g+wNNjLEg9FdDUf+t8MmDFLXdQxrNbSyskjFUQbXUPHvwTLpFyJ9M:gGnuNa4h39UXH4TLpU9MpR3
MD5 SHA1 SHA512 SSDEEP

windows x86

CrimsonRAT Main Payload

Minor OS version

Major OS version

Entry point

10099198

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing