Extracted

• • Target

    JaffaCakes118_b0513a2e9f11f2ebc7d739e84f9f9b98

  • Size

    195KB

  • MD5

    b0513a2e9f11f2ebc7d739e84f9f9b98

  • SHA1

    6b6cb092ee713f0caeebabec1fb855c95dc78445

  • SHA256

    e7d2e3ede3d3f5c6a83e124f853b69f535c261c47f1cf03e5d0aac518568966a

  • SHA512

    a9abf6abb993b9fb0baa9edf5a02da0be5af38e404021b9e0483b7af49f0c50aa2529c2a4b567f623a050b218cb94312224f3b7d4260d49e48598a0b6c982123

  • SSDEEP

    3072:5A2UsplBHR7MBcf/UAZ7M37Dbnz4j4hEvDAPxTgSkRRq4YT+R+SrPI//ou77Z:q2UIuyfvZE7v8j4hzgSWrwY

  Score

  10^/10

  crimsonratdefense_evasiondiscoverypersistencerat

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Crimsonrat family

    crimsonrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1