Extracted

• • Target

    The Deads Revenge.exe

  • Size

    104.1MB

  • MD5

    53cef85542a906baaaecd4ba69b36a88

  • SHA1

    ac3794aedb39edde36deb359b2f3dfd3519c55db

  • SHA256

    62cb74ffaa717c197cff301a177b079ab863720cb5c86d7d0bc5edb480026930

  • SHA512

    b119b67cf9ef76f24d58ca64016df448e611fa78ff60f90977acc4b7798e119c2bb2304037560bb2fef7369de3e0e2e68b8fc8a138fe3afcd841ccaf428c97af

  • SSDEEP

    3145728:A6gYRPSC++6y9Jk7pLX5M3gbcKC9/nX3SEv2x6:xxaC4y9eVLE2C9/HSEv2

  Score

  10^/10

  crimsonratevasionpersistenceratspywarestealer

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1