Extracted

• • Target

    The-MALWARE-Repo

  • Size

    298KB

  • MD5

    07c71f38ba70d3cd08780578f673366b

  • SHA1

    91920288a31959a00ba02ee68dbe64c874203e01

  • SHA256

    a2706ced712d733502af5ba0f15945a7c9744aa2fb1d9d98cc7aa3c128c5b523

  • SHA512

    56b93f6a9f77f715bca4b4fa07bfde2adf7440d8b01b8048bf1eb7cb6b446e15d0b4eaa9299dd001e3ea33d4c9fd30761334aebbccd9eb55528eeb50297b3cf6

  • SSDEEP

    6144:yLouSpOL/saqkPV9FemLtcsDSsmwF9VvZJT3CqbMrhryf65NRPaCieMjAkvCJv1N:AouSpOL/saqkPV9FemLtcsDSsmwF9Vv4

  Score

  10^/10

  discoverycrimsonratagilenetevasionpersistencerattrojan

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Crimsonrat family

    crimsonrat

  • UAC bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2