crimsonrat | f3a1ac021941b481ac7e2335b74ebf1e44728e8917381728f1f5b390c6f34706 | Triage

Sharing

General

Target

f3a1ac021941b481ac7e2335b74ebf1e44728e8917381728f1f5b390c6f34706
Size

10.5MB
MD5

30bc987b05c707e89f1a0b06e022459e
SHA1

48e33424d703d9566d8f6e41dff7cf8dd6053323
SHA256

f3a1ac021941b481ac7e2335b74ebf1e44728e8917381728f1f5b390c6f34706
SHA512

7a8578724a968f89ceacb2f698a95b606b7809c7b498de592adb4365161fa37cfb9fd41b6c38b3ba81dd081f646b7d278f788a84ba270563c0f682f1239a319d
SSDEEP

1536:gW6Uu3qctsb0MW3S0OnLS4IAY+2Nni36REAN:Yy8MWC24IAYNTEAN

Score

10^/10

crimsonrat

Malware Config

Extracted

Family

crimsonrat

C2

192.3.99.68

Signatures

Crimsonrat family
crimsonrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
f3a1ac021941b481ac7e2335b74ebf1e44728e8917381728f1f5b390c6f34706

Files

f3a1ac021941b481ac7e2335b74ebf1e44728e8917381728f1f5b390c6f34706
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\my new pro\addiz\ppt 68\hiartbnaiw\hiartbnaiw\obj\Debug\hiartbnaiw.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ