Phishing email attachments deliver Crimson RAT

Two separate spear-phishing email campaigns deliver Crimson RAT through an attachment and a link.
The link sent through mail contains a malicious PE (executable) file. It has two ZIP files and a DOC file embedded in the resource section.
The attachment sent along with the email has an embedded malicious macro

On execution, based on the OS version, the malicious attachments drop a 32-bit or 64-bit version of payload stored in the resources.
The ZIP payload is dropped and executed to deliver the RAT.
Once the RAT is executed, it loads a clean CV DOC file and then executes it.

Crimson RAT exfiltrates files and system data, transfers it over non-web channels to its command-and-control (C&C) server.
The malware, on its own, is also capable of capturing the screen of the target device and terminate any or all running processes.
It downloads more payloads from its C&C server to steal browser credentials and record keyboard strokes.