General

  • Target

    juicewrld.jpeg

  • Size

    152KB

  • Sample

    250317-a6378syjv4

  • MD5

    5252a0128845849d952cec74c84cbee7

  • SHA1

    2c5fce854b92be89c8ac62ba8ae136cdd1029307

  • SHA256

    dafa62260b8f61cb5d22c73cdc74c43a8c427bc28de420fb33a08f0f312b0b6d

  • SHA512

    416e886bdf9072682c070a7ef8cfa400815807c8711242e55fc7dd27628156f84cd31fa8c6b66767de4e399cdf5b7c7a139add6180a64ac9f7ff944c79d4a02e

  • SSDEEP

    3072:SMLL+MWEsIWEovj1GIliHyAHTZ5Vh2sVlv/+Ho8y+H:SM1WEiUI27Vwsrv/s3H

Malware Config

Extracted

Family

crimsonrat

C2

185.136.161.124

Targets

    • Target

      juicewrld.jpeg

    • Size

      152KB

    • MD5

      5252a0128845849d952cec74c84cbee7

    • SHA1

      2c5fce854b92be89c8ac62ba8ae136cdd1029307

    • SHA256

      dafa62260b8f61cb5d22c73cdc74c43a8c427bc28de420fb33a08f0f312b0b6d

    • SHA512

      416e886bdf9072682c070a7ef8cfa400815807c8711242e55fc7dd27628156f84cd31fa8c6b66767de4e399cdf5b7c7a139add6180a64ac9f7ff944c79d4a02e

    • SSDEEP

      3072:SMLL+MWEsIWEovj1GIliHyAHTZ5Vh2sVlv/+Ho8y+H:SM1WEiUI27Vwsrv/s3H

    • CrimsonRAT main payload

    • CrimsonRat

      Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    • Crimsonrat family

    • Downloads MZ/PE file

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks