Extracted

• • Target

    e87978f0af9bb550ab4686a7d3657e6cbfd92347744dfce8ff2321781ac2eee0.exe

  • Size

    18.7MB

  • MD5

    f5380e7a6e15a0ef27e6f31fcc29ed4d

  • SHA1

    ee9d4e5c19dc910ae46f8637ad6d738b55971238

  • SHA256

    e87978f0af9bb550ab4686a7d3657e6cbfd92347744dfce8ff2321781ac2eee0

  • SHA512

    795fb7bf5bf9b6b909735a3851c8df268c750d37ebc39fc446d655a5976a0e4ba39b19aa6ab8a7c7047bc8dfd30b26ea813fd614f4c29d867caac29df4ebfd7e

  • SSDEEP

    49152:a/6HjgQAOk7lEX8YHrdDTrr9mJjA1hcu9K5KP497IffvGe:U6Hj5AOkmMYLdf9m6V/1ffue

  Score

  10^/10

  crimsonratdiscoverypersistencerat

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Registers COM server for autorun

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1