Extracted

Extracted

Extracted

• • Target

    belge1.png

  • Size

    3.9MB

  • MD5

    bf5ef288a9835e272c3f2a67f7dd76f2

  • SHA1

    b8c2053e414148754b26cc358078aadb366c9a84

  • SHA256

    1347eab7618fa7c80e716cb6634f1a2f72a7c51a58afe59b3f57a2e35f957937

  • SHA512

    4355002506845f9cc68183cd6adf081bdf473dff275014b3586f8ff450a9ae4644f430b9358b55a8f82774494d9c6a0557e8fce857c99f26f1d17bee3a71d913

  • SSDEEP

    98304:6yrA2oNFsjHj9Ym9vEhmEj043Sk4ytSJM366c52HHMQg:Fz8sjH99adr3CYHMQg

  Score

  10^/10

  crimsonratlummanjratdefense_evasiondiscoveryevasionpersistenceprivilege_escalationratstealertrojan

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1