crimsonrat | 95cba4805f980e8c1df180b660e2abb4_JaffaCakes118 | Triage

Sharing

General

Target

95cba4805f980e8c1df180b660e2abb4_JaffaCakes118
Size

125KB
MD5

95cba4805f980e8c1df180b660e2abb4
SHA1

acf0dcf5981f383dd2558663e917907c058566ed
SHA256

75c62fd62a7a71ab357c578ed8af5a9e8b6fbcd6706242192f6012b83758993a
SHA512

33744769ca5da6fcbf7c3ade9ab75ef98118335387e2960c697efc46c00d99da2f5838b358122ad5ae617330e8acf01a0d0b07f5d1b900234521c10d6c6e1e68
SSDEEP

3072:YY5Bybw0rjiUvRpjiUvR63ULQwM9EsngL+0f1Z+SyDffoF:YY6nPzPzQ/9rOfOSy

Score

10^/10

crimsonrat

Malware Config

Extracted

Family

crimsonrat

C2

88.150.227.71

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
sample	family_crimsonrat

Crimsonrat family
crimsonrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95cba4805f980e8c1df180b660e2abb4_JaffaCakes118

Files

95cba4805f980e8c1df180b660e2abb4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Sami Personal Files\RAW DATA\F drive\BINDERS\Original OK\Binder\filescan\obj\x86\Debug\filescan.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ