Static task
static1
Behavioral task
behavioral1
Sample
rnthiavesa.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
rnthiavesa.exe
Resource
win10v2004-20220414-en
General
-
Target
ff25e1d9e3f44194869933b84ed4c3d5082e612fe97efec663e1ca8f68eb6848
-
Size
55KB
-
MD5
1c4e191cbfbd185e94b8719f25d0a508
-
SHA1
f7393896c97dd91b9ea4861381ed3d797066633d
-
SHA256
ff25e1d9e3f44194869933b84ed4c3d5082e612fe97efec663e1ca8f68eb6848
-
SHA512
d75b46531fe3f993949299332313854dbbd8b99d52e7a4a933cbd31bb8877dd6fb74bc2a99bf7c21032c49cacb7d7aa1e5a065deb1bb9898167aa64bca596a23
-
SSDEEP
384:PIWxW2QpuSi+cENWGDG8OVyNQwspbglLSeRLd0Tvcqy0:suSi+cgW1tVyGrkJHf4UM
Malware Config
Signatures
-
CrimsonRAT Main Payload 1 IoCs
resource yara_rule static1/unpack001/rnthiavesa.exe family_crimsonrat -
Crimsonrat family
Files
-
ff25e1d9e3f44194869933b84ed4c3d5082e612fe97efec663e1ca8f68eb6848.zip
-
rnthiavesa.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 9.6MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ