crimsonrat | dlrarhsiva[.]exe | Triage

Sharing

General

Target

dlrarhsiva.exe
Size

9.1MB
MD5

64261d5f3b07671f15b7f10f2f78da3f
SHA1

d4f978177394024bb4d0e5b6b972a5f72f830181
SHA256

87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad
SHA512

3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a
SSDEEP

768:nK6i7INFzKMNDOrt1Ln84KcN5jv7tLoQOoAdIERGo:K6C6PDEtN84PjSQOo2IeG

Score

10^/10

crimsonrat

Malware Config

Extracted

Family

crimsonrat

C2

185.136.161.124

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
sample	family_crimsonrat

Crimsonrat family
crimsonrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dlrarhsiva.exe

Files

dlrarhsiva.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\dlrarhsiva\dlrarhsiva\obj\Debug\dlrarhsiva.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 9.0MB - Virtual size: 9.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ