Extracted

• • Target

    .

  • Size

    147KB

  • MD5

    7596e5f6c22195d42712ce9e3fa1e2ee

  • SHA1

    4b63fbd1a9f7f90490ba92f42445c1aa6aa6eb1d

  • SHA256

    e283c42157d722bb609831eb3c93567a4b4b9aef31774c1f167a97cdddff9703

  • SHA512

    2688ca2ac3e90eab5c384ccb0634d685efa46c78b7ab1aadc9c16eeae903c8c9d2a954e03b83944295d54316ede780adc56861be326b97d710c1a7176be56100

  • SSDEEP

    1536:oRoiHxYHgVDxB38R4D6llsKwhU30vD932Gs4D07hqJS:CoZHgBM7llbpiC7hqJS

  Score

  10^/10

  crimsonrataspackv2defense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealer

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Modifies RDP port number used by Windows

  • Sets service image path in registry

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers COM server for autorun

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1