Campaigns / Malware / Family

Crimson

Crimson is a remote access Trojan that has been used by Transparent Tribe since at least 2016.

0New IOCs · 24h

40New IOCs · 7 days

40Indicators tracked

1Independent feeds

2026-10-09 01:31Last activity

New indicators per day

2026-09-29 to 2026-10-12, by first report.

Hash40
Malware40

MITRE ATT&CK lists this as malware Crimson. Explore the ATT&CK matrix →

Where its infrastructure is hosted

No location data.

Latest indicators

Filter the live feed →

First seen	Type	Indicator	Role	Where
2026-10-09 01:31	SHA256	1866f3ce039a8fda70bc2f906bd3e9e8479be85d5430373fd085e9ebca073b1c	Malware sample	—
2026-10-09 01:31	SHA256	796ae0b75c0e0b08ea84668495df4070	Malware sample	—
2026-10-09 01:31	SHA256	d53de7c980eb34f9369e342d5d235c9b	Malware sample	—
2026-10-09 01:31	SHA256	dc7dfbdcbc85a53687aab5badf1ba72a3de0f4f408ee1d6a617e70f8a0366093	Malware sample	—
2026-10-09 01:16	SHA256	3e894a4dde25f7967004664ac7a01077c8ffa8eb8c5e19470391441739249fb4	Malware sample	—
2026-10-09 01:16	SHA256	4d2ea7e21dc01b1f09eb9a407f375a118b2ffd4b42300ec601832a30eb0d089c	Malware sample	—
2026-10-09 01:16	SHA256	50eb7ae1d3c075dfc9c9e82a9fa9caf5	Malware sample	—
2026-10-09 01:16	SHA256	97d3eadbe9b85aeb07a0ad9fe11ff36fb34d60d4968917f9c8e3e89688e3c437	Malware sample	—
2026-10-09 01:16	SHA256	cceef110cce627efc934e35638a0b2bc0aa7a8d3effa6bd2744d0e7be4ba9749	Malware sample	—
2026-10-09 01:16	SHA256	eaee83a376914616924eab9b4b96b050	Malware sample	—
2026-10-09 01:16	SHA256	f1a2caf0dd7922ea3a64231fd5af7715	Malware sample	—
2026-10-09 00:31	SHA256	3a67ebcab5dc3563dc161fdc3c7fb161	Malware sample	—
2026-10-09 00:31	SHA256	56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c	Malware sample	—
2026-10-09 00:31	SHA256	5a6bec1a9c38f6857525cca40f64b2ed	Malware sample	—
2026-10-09 00:31	SHA256	6a69cd7a2cb993994fccec7b7e99c5daa5ec8083ba887142cb0242031d7d4966	Malware sample	—
2026-10-09 00:31	SHA256	84fb5d99db36d869cf03b6b3c559fa976d0ea17e112e91596ddc0b0079a6b2e0	Malware sample	—
2026-10-09 00:31	SHA256	a3aa3a12d81c9862b18f83a77d7215ca	Malware sample	—
2026-10-09 00:31	SHA256	bd4e0a30d74f4537f29a6a603427489e1d3f7d6da030afc5c199fe6b1a4d271f	Malware sample	—
2026-10-09 00:31	SHA256	df6be8accc487bf63260aacf5e582fe2	Malware sample	—
2026-10-09 00:17	SHA256	14be26aa207cff81ff814c8a7a8e2f03	Malware sample	—
2026-10-09 00:17	SHA256	28f457b4582701907d1cdaabbd9fdbea169185dc3e97925fd48589ef44e72812	Malware sample	—
2026-10-09 00:17	SHA256	34ad98510d4d6e24b7e38f27a24ad9f6	Malware sample	—
2026-10-09 00:17	SHA256	3dd14366762547c4aa2307489c6248dec4a57bec2231433b58cdf8c5e830785a	Malware sample	—
2026-10-09 00:17	SHA256	4fb7d5887a8305738abf81fd51d585cc0ab3816e7a54da57591797bbefab7509	Malware sample	—
2026-10-09 00:17	SHA256	50de9dfa7fda82584acafb9ef9ed816587316006865092a00c56b4b3177c2786	Malware sample	—
2026-10-09 00:17	SHA256	75798547f0ddca076070bcea67a0b064	Malware sample	—
2026-10-09 00:17	SHA256	79f7e1d6389c73a7e2525d0ec8fa3ce2	Malware sample	—
2026-10-09 00:17	SHA256	8a20bca39e9c61120ec2c2d5730e4945ec9c092fc2cd0c9e778937d3dfa0a6b5	Malware sample	—
2026-10-09 00:17	SHA256	92f78a182faf26550d6fab2d9ec0692d	Malware sample	—
2026-10-09 00:17	SHA256	c254e35f28045b68249b57b5d09942fee823a3e459d7f47b0ccb1b3b3b9f419f	Malware sample	—
2026-10-09 00:17	SHA256	dd3406409f33590aabf9bdfa7e55b6872f1d42ef96f1dec24072328072f54cec	Malware sample	—
2026-10-09 00:17	SHA256	e456d6035e41962a4e49345b00393dcd	Malware sample	—
2026-10-09 00:17	SHA256	eb01bbfe8ca7e8f59aab475ad1f18245	Malware sample	—
2026-10-08 15:25	SHA256	e6f4bb8ed235f43cb738447fbf1757c3	Malware sample	—
2026-10-08 15:25	SHA256	f49375748b279565b5aed83d9ee01eb2	Malware sample	—
2026-10-08 15:04	SHA256	7a18b1bf9b07726327ba50e549764731	Malware sample	—
2026-10-08 15:04	SHA256	a54c435bdbc17608fa0b8826bbe9936d	Malware sample	—
2026-10-08 15:04	SHA256	da2331ac3e073164d54bcc5323cf0250	Malware sample	—
2026-10-08 14:44	SHA256	e40e0a71efd051374be1663e08f0dbd8	Malware sample	—
2026-10-06 16:17	SHA256	0038d5c42e8085080cea2f240079c5c0d2464bf99729a9822b27eeeea849833b	Malware sample	—

Defanged for safety. URL query strings removed.

New indicators per day

Where its infrastructure is hosted

Latest indicators

Security check