Extracted

• • Target

    $ROWJ11R.exe

  • Size

    84KB

  • MD5

    b6e148ee1a2a3b460dd2a0adbf1dd39c

  • SHA1

    ec0efbe8fd2fa5300164e9e4eded0d40da549c60

  • SHA256

    dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

  • SHA512

    4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

  • SSDEEP

    1536:IjoAILD000jsdtP66K3uch3bCuExwwSV712fRp1Oo2IeG:IqLD000wD6VRhLbzwSv2H1beG

  Score

  10^/10

  crimsonratrat

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2