Extracted

• • Target

    Koid.exe

  • Size

    1.5MB

  • MD5

    15ec276e3c1d3d757eed8698c59c1095

  • SHA1

    28be0d3db48ef6423c2c4e222f5f949b8ed6e845

  • SHA256

    4bf92841621b08ec1796fa380fd71bd9f6fec65b923aec1dbd5b074f062eaf21

  • SHA512

    467196ee35523d4a24bd3746a9785040e092e4aba096c4e342ce1dfe2a9c3b1ca61f207b4581ac97a3861f12f714581854339727681aba1ba93d8e36ef9eb671

  • SSDEEP

    24576:u06LkHhLdZYQVoNVePYOEOKTyBHJsXoAFWlT4Adw/u1/XFlwTUOcA5qmr37Pn6:unkHhLdpPYO1M+Brgdhwmzrn6

  Score

  10^/10

  crimsonrataspackv2persistencerat

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Downloads MZ/PE file

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1