Behavioral task
behavioral1
Sample
0x0006000000015ca8-408.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0x0006000000015ca8-408.exe
Resource
win10v2004-20230220-en
General
-
Target
0x0006000000015ca8-408.dat
-
Size
13.0MB
-
MD5
827a3da12d83683d326d81c058c656ac
-
SHA1
3a988412a95d7129c6346a12336a6e3597a48f49
-
SHA256
6d372ac5ea7270b83a04ef72eaed5a87258cf612f4c52e4dd2a7e073e5913c5c
-
SHA512
142327a65bda6ac785908cc671d8c5a0c5418b651be789a0e442ede4a0d18cb0c25290f4f8edcc90e63c7be18ff2f2b556667cb2294af2a56df10b4243d91dec
-
SSDEEP
768:uUtpX42m7xcFM5tM5tMs9M5tM5tM5c5t9M5tM5tM5c5t9M5tM5tM5cD9M5tM5tM7:BX4fBGyMjo0bP1rwu08hHUS0bhq8DDa
Malware Config
Extracted
crimsonrat
172.245.80.12
Signatures
-
Crimsonrat family
Files
-
0x0006000000015ca8-408.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 12.9MB - Virtual size: 12.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ