Overview

overview

10

Static

static

10

Celestrial...ak.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Celestrial-Paid-Leak.exe

  • Size

    75.5MB

  • Sample

    240630-zgdcysvdma

  • MD5

    f039213abab7640ff26bcc39ede11aa9

  • SHA1

    50f929bd448dbe97255206ee6bb2031c2bf6a27b

  • SHA256

    72f3a785dac566d8284f4cd4356e9a83448bdfcbd2f66fa627c9ce52d1506a16

  • SHA512

    b81dae108fd5821765dce5de86c78db0695a51c57b332013a58b52cf2352c4581306749e95a94535866a48af8585b496d369624ecc30c0817620816f38b227c8

  • SSDEEP

    1572864:YvFUQ6lnSk8IpG7V+VPhqIbE7WTylPj4iY4MHHLeqPNLtDaSWQ1Z4w0g:YvFU1lSkB05awIxTy5nMHVLteSD10g

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      Celestrial-Paid-Leak.exe

    • Size

      75.5MB

    • MD5

      f039213abab7640ff26bcc39ede11aa9

    • SHA1

      50f929bd448dbe97255206ee6bb2031c2bf6a27b

    • SHA256

      72f3a785dac566d8284f4cd4356e9a83448bdfcbd2f66fa627c9ce52d1506a16

    • SHA512

      b81dae108fd5821765dce5de86c78db0695a51c57b332013a58b52cf2352c4581306749e95a94535866a48af8585b496d369624ecc30c0817620816f38b227c8

    • SSDEEP

      1572864:YvFUQ6lnSk8IpG7V+VPhqIbE7WTylPj4iY4MHHLeqPNLtDaSWQ1Z4w0g:YvFU1lSkB05awIxTy5nMHVLteSD10g

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

JavaScript

1
T1059.007

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

2
T1112

Credential Access

Discovery

File and Directory Discovery

1
T1083

Virtualization/Sandbox Evasion

1
T1497

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks