Extracted

Extracted

• • Target
    https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/RAT/CrimsonRAT.exe

  Score

  10^/10

  backdoorguestdefense_evasiondiscoveryexecutioncrimsonratfloxifrevengeratpersistenceprivilege_escalationratstealertrojanupx

  • CrimsonRAT main payload

  • Family: CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif

  • Family: RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Detects Floxif payload

    backdoor

  • RevengeRat Executable

    stealer

  • Downloads MZ/PE file

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Uses Verclsid to proxy-execute a COM object

    Verclsid is a signed Windows utility that verifies COM shell extensions. It can instantiate specific CLSIDs to execute malicious payloads under a trusted binary.

    defense_evasion

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1