crimsonrat

General

Target

redz hub.lua
Size

110B
Sample

250104-vdkkmszpbm
MD5

e64dc7639631f60e56ddf2ee462c73f3
SHA1

797012686a77f6b68860e26ab692fb5e5dd56190
SHA256

cf09c4bec1494405fa4c5c2a499cb8e17ac5bd8e31a65e0612c13c41ad8ab457
SHA512

b74992a1da0260565a52f5a7daf93a48199efdec57db36a8e08e1efb06aca815ef1cfac19928ec25127fa8390fce09996a407ed8dc5dd210ef49c9de942d6fdf

Score

10^/10

Malware Config

Extracted

Family

crimsonrat

C2

185.136.161.124

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  redz hub.lua
- Size
  
  110B
- MD5
  
  e64dc7639631f60e56ddf2ee462c73f3
- SHA1
  
  797012686a77f6b68860e26ab692fb5e5dd56190
- SHA256
  
  cf09c4bec1494405fa4c5c2a499cb8e17ac5bd8e31a65e0612c13c41ad8ab457
- SHA512
  
  b74992a1da0260565a52f5a7daf93a48199efdec57db36a8e08e1efb06aca815ef1cfac19928ec25127fa8390fce09996a407ed8dc5dd210ef49c9de942d6fdf
Score

10^/10

crimsonrat wannacry bootkit defense_evasion discovery evasion execution exploit impact persistence ransomware rat spyware stealer trojan worm
- CrimsonRAT main payload
- CrimsonRat
  Crimson RAT is a malware linked to a Pakistani-linked threat actor.
  rat crimsonrat
- Crimsonrat family
  crimsonrat
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Possible privilege escalation attempt
  exploit
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1