Extracted

• • Target

    download.png

  • Size

    4KB

  • MD5

    53be45ec1a8da5bf21e4af595221cd6e

  • SHA1

    78fe5f060e9ac3a34d16d0fcc74ae155622362b6

  • SHA256

    ea277f3d1af0d063b093aa6b1d74de1460c68c43b2656760e0dd86c3f1d8e50d

  • SHA512

    fd784b321a158d7e742d04730f066283a45c28e8f37aa40c058236c0154a18dee019f6d608991d090bc68f37681141494f3f300ca07f5fb21bbb0cacf59fc328

  • SSDEEP

    96:oKShRfnDx46uwJtb7VxWV7F49qqRQGtCTWxpyMFck6rDrsOL0C7136IqejOZtCtY:oKSHDKrwLVgqqqRQOwWxD6ksrsON7130

  Score

  10^/10

  crimsonratdefense_evasiondiscoverymacromacro_on_actionrat

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1