Crimson RAT
Crimson RAT is a custom .NET remote access trojan widely associated with Transparent Tribe/APT36 (also tracked as COPPER FIELDSTONE, Operation Transparent Tribe, ProjectM, Mythic Leopard, and Storm-0156), a Pakistan-linked espionage actor. Public reporting describes it as a long-running espionage tool used primarily against Indian government, military, diplomatic, academic, defense-adjacent, and more recently startup targets, with some reporting also noting activity focused on Afghanistan.
Observed delivery methods include spear-phishing emails with malicious Microsoft Office documents containing VBA macros, weaponized Excel files, ISO container attachments, ZIP archives, and malicious LNK shortcuts. Reported infection chains include macros reconstructing and extracting ZIP payloads to %ALLUSERPROFILE%/ProgramData paths, and ISO/LNK chains that launch batch scripts and PowerShell, display decoy documents, and execute a Crimson RAT payload disguised as an Excel file. Reporting also notes exploitation of WinRAR CVE-2023-38831 in campaigns delivering Crimson RAT, as well as Indian government-themed and startup-themed lures.
Capabilities directly described in the source material include remote command execution; process listing and termination; file system browsing, search, upload/download, and exfiltration; screenshot capture and in some cases live screen streaming; persistence via Windows Registry Run keys and Startup-folder/LNK mechanisms; downloading and executing additional payloads; system reconnaissance; and collection of victim metadata such as machine name, username, OS version, IP/NIC, client ID, and installation path. Broader reporting on the Crimson tooling ecosystem also attributes microphone audio surveillance, webcam capture, keystroke logging, browser password theft, removable-media theft, and USB-worm functionality to related Crimson components managed through the Crimson Server C2.
Technical details in the provided content include use of custom TCP-based C2 on non-standard ports. One analyzed variant using the namespace dhrwarhsav hard-coded C2 IP 107.175.64.209 and attempted connections over ports 6728, 8661, 10614, 14822, and 18443; it used a custom length-prefixed UTF-8 protocol, copied itself for persistence, and set HKCU\Software\Microsoft\Windows\CurrentVersion\Run\_dreb. Another campaign report listed Crimson RAT communications over ports 18661, 20856, 26868, 29261, and 36628. A May 2025 report identified C2 infrastructure at 93.127.133.58:1097. Additional file/path artifacts mentioned in reporting include dhrwarhsav.exe, dorbanvca.exe, Book1.xls, and ProgramData paths such as C:\ProgramData\Edlacar, %ALLUSERPROFILE%\Media-List\tbvrarthsa.zip / tbvrarthsa.exe, and C:\ProgramData\Dacr\macrse.exe.
The malware is described as using evasion and anti-analysis measures including hidden WinForms execution, randomized function names, artificial file-size inflation with junk data, avoidance of certain system directories during traversal, and use of decoy documents to distract victims. Overall, the content consistently characterizes Crimson RAT as a mature espionage-focused RAT central to Transparent Tribe/APT36 operations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2024-12-04 ⋅ Microsoft Threat Intelligence Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage Crimson RAT MiniPocket TwoDash Wainscot
Techniques & procedures
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques“spread across systems by infecting removable media… USB Worm… infect removable devices with a copy of USBWorm itself”
“PowerPoint add-on files (.ppam)… contain malicious macros that, when enabled… initiate the malware download process.”
“PDFs… embed malicious links… redirect users to fake login pages hosted on spoofed domains… designed to steal credentials.”
Execution
4 techniques"The script uses PowerShell commands to remove security warnings that would normally alert users about suspicious files."
“execute arbitrary commands… execute commands with COMSPEC and receive the output… This tab allows the attacker to execute arbitrary commands on the remote machine.”
"When someone opens what appears to be an Excel spreadsheet, they unknowingly activate a chain of hidden commands that install Crimson RAT..."
“doc requires enable-content/double-click… enabling macros… initiat[es] the infection process.”
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
3 techniques“Obfuscated/Encrypted File T1027… Eazfuscator, string padding.”
"...malicious files disguised as legitimate documents"; "...a shortcut file masquerading as an Excel document..."; "...payload disguised as an excel executable."
"...file appears artificially inflated to 34 megabytes through embedded junk data... This bloating technique helps bypass signature-based detection systems."
Discovery
3 techniques“get a process list… kill a process… Process manager: The attacker can obtain a list of running processes and terminate these…”
“Commands such as filsz, listf, and fldr enables the malware to list, access, and download files.”
“tries to circumvent certain vendors’ security tools by configuring the Server to prevent installation of some… components… on systems protected with Kaspersky… and… ESET.”
Lateral Movement
1 techniqueCollection
4 techniques“steal files from removable media… Auto File Download… configure the bot to search files, filter results and upload multiple files… steal files of interest from removable devices”
“capture screenshots… designed for monitoring the remote screen… continuously send screenshots to the server…”
“perform audio surveillance using microphones… The malware uses the NAudio library to interact with the microphone… pushed to the victim’s machine using a special command.”
“record video streams from webcam devices… spying on a remote webcam and performing video surveillance.”
Command and Control
3 techniques“Crimson RAT connects to its hardcoded C2 server… 93.127.133.58 (port 1097)… direct TCP C2 on rotating ports.”
“uploading Crimson components and executing these on remote system… download and upload files… USBWorm… download and execute the Crimson ‘Thin Client’… connect to a remote Crimson Server…”
"It communicates with command-and-control servers using custom TCP protocols on non-standard ports including 18661, 20856, 26868, 29261, and 36628."
Exfiltration
1 technique“Once the malware has collected sensitive data… it sends this data back to the C2 server… files sent via C2.”
IOCs tracked for this family
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan referenced in Secret Blizzard espionage activity and Snowblind reporting.
Remote access trojan delivered via ISO containers and LNK shortcuts in lure-based campaigns to provide remote control and data theft capability.
Remote access trojan used by Transparent Tribe/APT36 to compromise targets via ISO-delivered payloads; provides remote surveillance and control capabilities including screen monitoring, audio recording, file theft, and system control. Uses evasion such as file-size bloating with junk data and randomized function names; communicates to C2 over a custom TCP protocol on non-standard ports.
Remote access trojan used for surveillance, data exfiltration, and host reconnaissance; delivered via spear-phishing ISO containing a malicious LNK and staged payloads.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.