# APT36 Spreads Fake Coronavirus Health Advisory Delivers Crimson RAT

**URL:** <https://onehack.st/t/apt36-spreads-fake-coronavirus-health-advisory-delivers-crimson-rat/74489>\
**Category:** News & Articles\
**Tags:** hacking, news\
**Created:** [March 22, 2020, 6:46am UTC](https://onehack.st/t/apt36-spreads-fake-coronavirus-health-advisory-delivers-crimson-rat/74489 "2020-03-22T06:46:23Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [March 22, 2020, 6:46am UTC](https://onehack.st/t/apt36-spreads-fake-coronavirus-health-advisory-delivers-crimson-rat/74489/1 "2020-03-22T06:46:24Z")

</div>

> **[APT36 jumps on the coronavirus bandwagon, delivers Crimson RAT - ThreatDown...](https://www.threatdown.com/blog/apt36-jumps-on-the-coronavirus-bandwagon-delivers-crimson-rat/)**
>
> Upon running the payload, Crimson RAT connects to its hardcoded C&C IP addresses and sends collected information about the victim back to the server, including a list of running processes and their…

### APT36 spreads fake coronavirus health advisory

APT36 mainly relies on both [spear phishing](https://blog.malwarebytes.com/social-engineering/2020/01/spear-phishing-101-what-you-need-to-know/) and watering hole attacks to gain its foothold on victims. The phishing email is either a malicious macro document or an rtf file exploiting vulnerabilities, such as CVE-2017-0199.

In the coronavirus-themed attack, APT36 used a spear phishing email with a link to a malicious document (Figure 1) masquerading as the government of India ( _email.gov.in.maildrive[.]email/?att=1579160420_ ).

[![](https://blog.malwarebytes.com/wp-content/uploads/2020/03/1-1.png)](https://blog.malwarebytes.com/wp-content/uploads/2020/03/1-1.png)

Figure 1: Phishing document containing malicious macro code

[![](https://blog.malwarebytes.com/wp-content/uploads/2020/03/3-1.png)](https://blog.malwarebytes.com/wp-content/uploads/2020/03/3-1.png)

Figure 2: malicious macro

Based on the OS type, the macro picks either a 32bit or 64bit version of its RAT payload in zip format that is stored in one of the two textboxes in UserForm1 (Figure 3).

[![](https://blog.malwarebytes.com/wp-content/uploads/2020/03/4-600x393.png)](https://blog.malwarebytes.com/wp-content/uploads/2020/03/4.png)

Figure 3: embedded payloads in ZIP format

### Crimson RAT

The Crimson RAT has been written in .Net (Figure 4) and its capabilities include:

- Stealing credentials from the victim’s browser
- Listing running processes, drives, and directories on the victim’s machine
- Retrieving files from its C&C server
- Using custom TCP protocol for its C&C communications
- Collecting information about antivirus software
- Capturing screenshots

[![](https://blog.malwarebytes.com/wp-content/uploads/2020/03/2-1.png)](https://blog.malwarebytes.com/wp-content/uploads/2020/03/2-1.png)

Figure 4: Crimson RAT

Upon running the payload, Crimson RAT connects to its hardcoded C&C IP addresses and sends collected information about the victim back to the server, including a list of running processes and their IDs, the machine hostname, and its username (Figure 5).

[![](https://blog.malwarebytes.com/wp-content/uploads/2020/03/5.png)](https://blog.malwarebytes.com/wp-content/uploads/2020/03/5.png)

Figure 5: TCP communications

### Indicators of Compromise

Decoy URLs

email.gov.in.maildrive[.]email/?att=1579160420  
email.gov.in.maildrive[.]email/?att=1581914657

Decoy documents

876939aa0aa157aa2581b74ddfc4cf03893cede542ade22a2d9ac70e2fef1656  
20da161f0174d2867d2a296d4e2a8ebd2f0c513165de6f2a6f455abcecf78f2a

Crimson RAT

0ee399769a6e6e6d444a819ff0ca564ae584760baba93eff766926b1effe0010 b67d764c981a298fa2bb14ca7faffc68ec30ad34380ad8a92911b2350104e748

C2s

107.175.64[.]209 64.188.25[.]205

### MITRE ATT&CK

> **[Crimson, Software S0115 | MITRE ATT&CK®](https://attack.mitre.org/software/S0115/)**