Extracted

• • Target

    b5c8e2afa1091e9513da06cfaa1ceed25e091692cdfe7f304e367c58957e2d63.exe

  • Size

    15.8MB

  • MD5

    3a231bcc60569143aa899295e4a5ce8a

  • SHA1

    8916cceb3f1b309d866bea10da41465baf720b00

  • SHA256

    b5c8e2afa1091e9513da06cfaa1ceed25e091692cdfe7f304e367c58957e2d63

  • SHA512

    849557a31b08576b1be102767dbdf182b3f914d71c25bd3a25cc0e5748c9942ec41f910276a5f51b3f100a432443f0490b7f2fc4f1d3bd79cd22ca66291dde0b

  • SSDEEP

    1536:kAMDtajawvNhkim7VQe4tkYSWannmvZLVWn3M:PdPkim7VQjtkqnD83

  Score

  10^/10

  crimsonratratadwarediscoverypersistenceprivilege_escalationstealer

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Crimsonrat family

    crimsonrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2