Researchers uncovered a new wave of an APT campaign that target the Indian financial institutions with the powerful Crimson RAT to compromise the network devices and exfiltrate the sensitive data.
Crimson RAT was initially observed in 2016 that targeted the Indian diplomatic and military resources on behalf of APT attack, since then threat actors are continuously targeting the financial, healthcare, and space technology sectors.
The recently observed campaign has specifically targeted the Indian Financial institutions with spear-phishing emails.
Crimson RAT Infection Process
A Phishing email campaign contains a malicious attachment and the email send to a targeted organization in two different ways.
A first method malformed Email campaign hit the target with a malicious link that pointed to PE (executable) file that contains two ZIP files with an embedded document.
Once the payload executed by the victim, it automatically checks the OS version of the system and report to the C2 server and drop the ZIP payload based on 32-bit or 64-bit version.
According to zscaler report “The ZIP payload is dropped at C:\ProgramData\Bhoithas\dhdxcia.zip, after which the ZIP file is extracted in the same directory with the name brwmarivas.exe, and then it’s executed, which results in the Crimson RAT.”
Another spear-phishing campaign contains a malformed DOC file that has embedded with malicious macro, once victims enable the macro it executes the RAT payload and loads the clean Resume/CV file.
“Similar to Campaign 1, two PE files are stored in the value of Textboxes of UserForm1. Based on the OS version of the victim’s system, it drops a Crimson RAT payload at C:\ProgramData\Hblondas\rihndimrva.exe and executes it.”
Crimson RAT has running following command to perform the respective operation.
| Commands | Descriptions |
|---|---|
| getavs | List of running processes |
| thumb | Get 200×150 thumbnail of image |
| filsz | Get the file meta info |
| rupth | Get the malware’s run path |
| dowf | Get file from C&C and save on disk |
| endpo | Kill a process by PID |
| scrsz | Get the screen size |
| cscreen | Get single screenshot |
| dirs | List the drive info |
| stops | Stop screen capturing |
| scren | Capture screen continuously |
| cnls | Stop upload, download & screen capture |
| udlt | Download a payload from C&C, save & execute it |
| delt | Delete provided file |
| afile | Upload file with meta info to C&C |
| listf | Search for given extension files |
| file | Upload a file to C&C |
| info | Send machine info |
| runf | Execute a command |
| fles | List files in a directory |
| dowr | Get file from C&C and execute |
| fldr | List folders in a directory |
Crimson RAT has a function to exfiltrate the sensitive data from the compromised victim and transfer the collected data over non-web channels to its command-and-control (C&C) server.
The RAT keeps receiving the commands from the C&C server, performs the desired activities and keeps update the result to the C2 server that controlled by the attacker.
You can share your thoughts about the article via  Twitter,  Facebook and Linkedin page also get the Daily cyber security & hacking news updates.
