crimsonrat | 0x0006000000016d66-197[.]dat | Triage

Sharing

General

Target

0x0006000000016d66-197.dat
Size

16.9MB
MD5

55b3cfd78d9e2624d769acdfc5522753
SHA1

38a7f5b0ca7f508497bbfb42d32184b001367308
SHA256

504c7549caa901ca24a04915fe221236b3f41c947c7857c9d4634f3dbe31592e
SHA512

c1268ce97ad5c3f242ab78aeefb93fdbb06c693a149927240041c88db93ddb427d277459273b035263ae344da42044b3f449af0235310c547a437b14c869d608
SSDEEP

768:eaQjTpc2IVZM23zLnh8nLZ7FLOMaabW8FqZRGT7O:ZQjTpcpZM23PhqLZ7YmxY7c

Score

10^/10

crimsonrat

Malware Config

Extracted

Family

crimsonrat

C2

204.44.124.81

Signatures

Crimsonrat family
crimsonrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
0x0006000000016d66-197.dat

Files

0x0006000000016d66-197.dat
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 16.9MB - Virtual size: 16.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ