Crimson

Crimson RAT is a Windows-based remote access trojan associated with Transparent Tribe. It has been used in targeted intrusion activity and has also appeared as a payload delivered through the WhiteShadow malware delivery chain, including campaigns using malicious Microsoft Office documents with VBA macros as the installation mechanism. Crimson supports post-compromise surveillance and host profiling functions, including screen capture, process listing, collection of the current username, discovery of local network information such as MAC and LAN IP addresses, identification of installed antivirus software, and retrieval of system date and time. It also includes a module for stealing credentials stored in web browsers, giving it credential-access functionality in addition to remote administration features. For persistence, Crimson can add Windows Registry Run entries and maintain installation metadata in the Registry. It can also decode an encoded PE payload prior to execution and delete files from compromised hosts. Additional reporting has noted its ability to identify removable drives for file extraction. The malware is primarily relevant to Windows espionage-oriented operations and victim environments targeted by Transparent Tribe.