crimsonrat | bffe4ad80bca5fde40911ec90cb10616 | Triage

Sharing

General

Target

bffe4ad80bca5fde40911ec90cb10616
Size

9.4MB
MD5

bffe4ad80bca5fde40911ec90cb10616
SHA1

bdcdccea99540f05f6ed37e5b948335ba9077db5
SHA256

ac8e713b699fd019b67cbaca58cc35738e05b3308c5abda28656a3097cb4c672
SHA512

008ca396b4a2f3fee3971b6207b01b8c4a9f4b7de8cff9de017618d5994696734dc67c21d4cf64606ea47836087bf46558a33eb37af1799e6bec7927100e1b65
SSDEEP

768:gY6ouDBEyfsvPYDe85PzZ3W9q74CkOoV4WnNv98knMLGsG:gY6ouBCvPYXA44NlvsG

Score

10^/10

crimsonrat

Malware Config

Extracted

Family

crimsonrat

C2

134.119.181.15

Signatures

CrimsonRAT main payload 1 IoCs

Processes:

resource yara_rule

sample family_crimsonrat
Crimsonrat family
crimsonrat
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

bffe4ad80bca5fde40911ec90cb10616

Files

bffe4ad80bca5fde40911ec90cb10616
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\mstdhcasxl\mstdhcasm\obj\x86\Debug\mstdhcasm.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 9.4MB - Virtual size: 9.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ