     Figure 14. CrimsonRAT malware hosted in viral91[.]xyz     We were also able to source a phishing document, “csd_car_price_list_2017,” that is related to this domain and has been seen in the wild in 2017.