Extracted

• • Target
    library
  • Size 33KB
  • SHA256 521a23dc74f1205aaa40bd0d73036be8382f692862ffa1878b5ef6eae0f8d547
  • MD5 c0b0250f5435f6a5320d1c772062c5b7
  • SHA1 87e9055ba887a61a359ec487da5bb12b0d18278e
  • SHA512 a2eb7e1bed6f7331c0c4c9c5337fd626033ed0247df273fffc73f57e976e0abede6ff6ff7aa4b17dc51fc5a4a222bbbc65da3cdaa27451f05a6a0074671fb36e
  • SSDEEP 768:U7g/i5leOfMXqS5PHvJingqna03O7m7Y7AYlOm+BhGoyI7imS:3/i54OfeqS5PRingqna03O7m7Y7KKNIY
  • TLSH
    T1EBE2932661F7B87700A391F1299A070ABDE3422BC65E891176FD069D9FE2F46ED031C9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutioncrimsonratsevenpersistenceransomwareratspywaretrojan

  • CrimsonRAT main payload

  • Family: CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Family: Seven, SevenCrypt, 7ev3n

    Seven aka SevenCrypt or 7ev3n is a ransomware.

    ransomwareseven

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    defense_evasiontrojan

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2