Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
rgiwsdasxa.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
rgiwsdasxa.exe
Resource
win10-en-20211208
General
-
Target
3c17f3d21fddf3a1a902247d48bfbe291c2267fe7f7ce9de364ae7dff81c2eaf
-
Size
64KB
-
MD5
e0e9c625adab63c255a0e16fe8683189
-
SHA1
0080c82c91c89375208cd8e7b48d3851a01dfdc7
-
SHA256
3c17f3d21fddf3a1a902247d48bfbe291c2267fe7f7ce9de364ae7dff81c2eaf
-
SHA512
967c35929260416aa0b4138ed19e26aea0e37640a92bb77eb1df9cca31a034e2d17ca761eeddfae08c8e30214ca389cfe755550657f25f892704b52a0a6d20f7
-
SSDEEP
384:pWFCnGf7dY15r0oCnBJBhg6I0uQnsUjz9tt3wvJfHl/:pA5f7djZBJLg30tsUjz9ttUJfHZ
Malware Config
Signatures
-
CrimsonRAT Main Payload 1 IoCs
resource yara_rule static1/unpack001/rgiwsdasxa.exe family_crimsonrat -
Crimsonrat family
Files
-
3c17f3d21fddf3a1a902247d48bfbe291c2267fe7f7ce9de364ae7dff81c2eaf.zip
-
rgiwsdasxa.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 9.0MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ