APT Hackers Attack Indian Financial Institutions To Exfiltrate the Sensitive Data With Crimson RAT

Researchers uncovered a new wave of an APT campaign that target the Indian financial institutions with the powerful Crimson RAT to compromise the network devices and exfiltrate the sensitive data.

Crimson RAT was initially observed in 2016 that targeted the Indian diplomatic and military resources on behalf of APT attack, since then threat actors are continuously targeting the financial, healthcare, and space technology sectors.

The recently observed campaign has specifically targeted the Indian Financial institutions with spear-phishing emails.

Crimson RAT Infection Process

 A Phishing email campaign contains a malicious attachment and the email send to a targeted organization in two different ways.

A first method malformed Email campaign hit the target with a malicious link that pointed to PE (executable) file that contains two ZIP files with an embedded document.

Once the payload executed by the victim, it automatically checks the OS version of the system and report to the C2 server and drop the ZIP payload based on 32-bit or 64-bit version.

According to zscaler report “The ZIP payload is dropped at C:\ProgramData\Bhoithas\dhdxcia.zip, after which the ZIP file is extracted in the same directory with the name brwmarivas.exe, and then it’s executed, which results in the Crimson RAT.”

Another spear-phishing campaign contains a malformed DOC file that has embedded with malicious macro, once victims enable the macro it executes the RAT payload and loads the clean Resume/CV file.

“Similar to Campaign 1, two PE files are stored in the value of Textboxes of UserForm1. Based on the OS version of the victim’s system, it drops a Crimson RAT payload at C:\ProgramData\Hblondas\rihndimrva.exe and executes it.”

Crimson RAT has running following command to perform the respective operation.

Commands	Descriptions
getavs	List of running processes
thumb	Get 200×150 thumbnail of image
filsz	Get the file meta info
rupth	Get the malware’s run path
dowf	Get file from C&C and save on disk
endpo	Kill a process by PID
scrsz	Get the screen size
cscreen	Get single screenshot
dirs	List the drive info
stops	Stop screen capturing
scren	Capture screen continuously
cnls	Stop upload, download & screen capture
udlt	Download a payload from C&C, save & execute it
delt	Delete provided file
afile	Upload file with meta info to C&C
listf	Search for given extension files
file	Upload a file to C&C
info	Send machine info
runf	Execute a command
fles	List files in a directory
dowr	Get file from C&C and execute
fldr	List folders in a directory

Crimson RAT has a function to exfiltrate the sensitive data from the compromised victim  and transfer the collected data over non-web channels to its command-and-control (C&C) server. 

The RAT keeps receiving the commands from the C&C server, performs the desired activities and keeps update the result to the C2 server that controlled by the attacker.

You can share your thoughts about the article via  Twitter,  Facebook and Linkedin page also get the Daily cyber security & hacking news updates.