APT Hackers Attack Indian Financial Institutions To Exfiltrate the Sensitive Data With Crimson RAT

Researchers uncovered a new wave of an APT campaign that target the Indian financial institutions with the powerful Crimson RAT to compromise the network devices and exfiltrate the sensitive data.

Crimson RAT was initially observed in 2016 that targeted the Indian diplomatic and military resources on behalf of APT attack, since then threat actors are continuously targeting the financial, healthcare, and space technology sectors.

The recently observed campaign has specifically targeted the Indian Financial institutions with spear-phishing emails.

Crimson RAT Infection Process

 A Phishing email campaign contains a malicious attachment and the email send to a targeted organization in two different ways.

A first method malformed Email campaign hit the target with a malicious link that pointed to PE (executable) file that contains two ZIP files with an embedded document.

Once the payload executed by the victim, it automatically checks the OS version of the system and report to the C2 server and drop the ZIP payload based on 32-bit or 64-bit version.

According to zscaler report “The ZIP payload is dropped at C:\ProgramData\Bhoithas\dhdxcia.zip, after which the ZIP file is extracted in the same directory with the name brwmarivas.exe, and then it’s executed, which results in the Crimson RAT.”

Another spear-phishing campaign contains a malformed DOC file that has embedded with malicious macro, once victims enable the macro it executes the RAT payload and loads the clean Resume/CV file.

“Similar to Campaign 1, two PE files are stored in the value of Textboxes of UserForm1. Based on the OS version of the victim’s system, it drops a Crimson RAT payload at C:\ProgramData\Hblondas\rihndimrva.exe and executes it.”

Crimson RAT has running following command to perform the respective operation.

Commands    Descriptions  
getavsList of running processes
thumbGet 200×150 thumbnail of image
filszGet the file meta info
rupthGet the malware’s run path
dowfGet file from C&C and save on disk
endpoKill a process by PID
scrszGet the screen size
cscreenGet single screenshot
dirsList the drive info
stopsStop screen capturing
screnCapture screen continuously
cnlsStop upload, download & screen capture
udltDownload a payload from C&C, save & execute it
deltDelete provided file
afileUpload file with meta info to C&C
listfSearch for given extension files
fileUpload a file to C&C
infoSend machine info
runfExecute a command
flesList files in a directory
dowrGet file from C&C and execute
fldrList folders in a directory

Crimson RAT has a function to exfiltrate the sensitive data from the compromised victim  and transfer the collected data over non-web channels to its command-and-control (C&C) server. 

The RAT keeps receiving the commands from the C&C server, performs the desired activities and keeps update the result to the C2 server that controlled by the attacker.

You can share your thoughts about the article via  Twitter,  Facebook and Linkedin page also get the Daily cyber security & hacking news updates.

Leave a Reply