crimsonrat | 947e75dc1f9b8a6d74a6d55afa7513ed86db907965cf0935ebb26c17f0ec6c5d | Triage

Sharing

General

Target

jivarthr edis.exe
Size

15.8MB
Sample

250216-yzgyesxqgt
MD5

fed22809d70062733cd1c34e16b75c05
SHA1

4520676983fcc20cfc4ca5be1e2a7566f3491ffb
SHA256

947e75dc1f9b8a6d74a6d55afa7513ed86db907965cf0935ebb26c17f0ec6c5d
SHA512

b0f54b6e3d5917e9aebab614391ec8f1bb8c00ba9d366f707e02fa17582f4f7101aefa434291fd031d5bd0407c06dd2ed9fbabe5d7e8f5bd34bdb0240529c98d
SSDEEP

1536:PKIY5Xp3x4T++qqIH6LVQe4tkYSWannmvZLVWn3M:P0ZVFqIaLVQjtkqnD83

Score

10^/10

crimsonrat discovery

Malware Config

Extracted

Family

crimsonrat

C2

209.127.18.107

101.125.206.108

Targets

- Target
  
  jivarthr edis.exe
- Size
  
  15.8MB
- MD5
  
  fed22809d70062733cd1c34e16b75c05
- SHA1
  
  4520676983fcc20cfc4ca5be1e2a7566f3491ffb
- SHA256
  
  947e75dc1f9b8a6d74a6d55afa7513ed86db907965cf0935ebb26c17f0ec6c5d
- SHA512
  
  b0f54b6e3d5917e9aebab614391ec8f1bb8c00ba9d366f707e02fa17582f4f7101aefa434291fd031d5bd0407c06dd2ed9fbabe5d7e8f5bd34bdb0240529c98d
- SSDEEP
  
  1536:PKIY5Xp3x4T++qqIH6LVQe4tkYSWannmvZLVWn3M:P0ZVFqIaLVQjtkqnD83
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2