���Z�NӴ� �̥H��6U�QͱHG8�YbH[�������XX+6B��@^(Y����9�x��7�lاչ���f���2��2���<b��Ⱦ:���MJ�1�h�-%qs�!��� �OZ�]ï&y���֢-�L�-s]}��l��!+��U��q��vI�u��Ʒ:���:�'�ع`e'l�N�u⩆~5����G PviV\ݏ[,�FH�$� H } o_wM8�4��!�iגВ���z}����(P���M$�ە��݈1�n����� mY��Ғs�3+}^o���T(�T0���4G���xg��z��ͱ"���+���js|ns�m���x,b�������Tsm�Uf4ܘjY�td����?|��x"�qDLy��ԍ���-�Z�J���Q�n�d{�>9����/����HV��L�チ�"v�v�ծEOr����dA��r�.{�5-'������w�MK����T�h�\J��a��I�blK��'� ٳ�'�?8�8}�f��@ �LMetV�h���ϵ_��/u���kt�B����m[�����2�Y�O&\LK$�X���<�^�����0r�i��LlO9���H�w�t>�߭� ��җ����4_�'�i^��,dHB�r�`QI0Ÿ�O�Iv?���KtA��1��v�̈���9Eܺ�7? �v���{gp�bt��&��p� _���_�k�M��Jrq�!�iꕬ��\���J>�~�౿I:�%��X������"�4����� hV�E����Z��j�CC�~٤5�dգR�4a�H��E����o�<�>-�/�R�!��$�F�LO�K�@��%l\��˒�Iy5Q�r���(m�Q��� �x�[�d�>�8�0FE�5 ���3Ŧ��jXD�v� ��0���%g�թ�Fl7��9p��|hvz��{s�i/�j����" �I���vH��pß㽁��� 4�3��Va�F���o�� Cd�������������뤃�����p�\9�P+�g�̼Y���;��9���v���ќ�wY�4ި\�����2�6����lO�ɋH6� ��YSѡ��%8J{0ޜ/�v$8�&A���6�^�^�?pˉ<h��&'E�m�-����0k%[�,���H(�Jԣ���>����܂'�SN�d��R����u��Tk��h�/M��������-��y3W����>ů�*Ɍ��kL`���Y���� �}��WJ�Yá�����x5�E]qӈ��/t�8��u¡b�q�(; m�����Qsk���Y�d�_��{�n�.8Y� ��Y��A1N�ίJW�4�'A�3;)�q�i<Ňh700�0ك���� f2N*9�qx�3.�������2����4R'"|�e�H䷋I]FQ�I�Hg4�"�3�����+5��9B ���?k�㠎z~����a���!93i���s�_��-���;М�/����۸PE)`Sޕ��'�^�6��j+ �!���6쫿f�d�e�4<�ky2^&��9ɫ<Zmq�&\���w�z�Hs���V�r������vK���W��Z���~ ��#�<S�l��Sc�N����7�fW���� s��U��@�>u�f����(�m�t����5/|�����ւ����6*�rsI���n���p����-�x� ��K�:����ӑ�K�;���mT�[dg�����(a�;w$M��o��=�?,駺�wdb���n�����,�f�g�r۸鏖C(�d��;}V�;k�3��>__~��3��kw����3��U�Y3B�B�����&y�"\M�Ϊ�q�O�Fv�W?�l�b�n���Io�Rl_^����RzYOU���(�G�%�!RPL��˘�g� ���>���'��Z�}J�\N+x�U�Aa ��"�çњJ���4��z.�2�~*X��Z�:#�@�@�v�q#V�c�G��&�9��)���A����*�Ƈ�,�O�OW�0Y�f����sI�C�I8z�E��f4�YЅ�ߖTDRQ_�N� {}�aU*~�Ĥ�S�������2��Ҧu��q���W���jک�*Տ�b�n}�Y��}c�7�t��|��Z EEJ��C�t/1H��tL�N�M! QI/�c�&�3kHGHO�x�����-jx�E��M��ՙ����?Qѵ�-T�U�P�����!VݚVK>L�q)��w#��8<����&�?5���a������e�7L�q�=+��DhqK�����ӂS��3N�moMtD8\��6�+�q�V��m�!��)��[Q��%��)�.M��et�X�J���Y�X3!������K��xL�ܙ�������a�Y��`xӵ���@�3�srvŹ6��B( ��w�m���<��dO�c;ҳPP<&�c�e�h�7�s���/Y�O�A��#7���q��ˊ��t,��.�C���_�@/i_��7k���*�����V�[e8qt������ºn����gvM�9�U�٠��� �0=�y����� �3�.(�^m`��4��6eo�� пo̐����D��� nz�-(�U��*JK��Y Ou�A�B���`��#8%�&�o�� #��nV;jjo� ��(lj��䅐6� �h�U�jP5��E�u����=�:?$�(�3��R`T���y+�m,7�nA<�����=ə�?�_ O�?/BOM:��v����L�l�4!np�췡܄��@��v��B�{X?!����6J�} ��g]xL��C�%m�ձ�a3Pqot:%GC:����&��o���e�|�g������ä�MG �Gr���X$�tp����g$�+�ۘ8;�~ZH�ܶ�o}@�����ƺ�)ݙO��ެMi�y5���Z�C9�\�O�(���0�`5\��Q��� ���̳������~�W�J��cp�����W���"��_,��(�z@Y����5(e�1B�QFXc#2�cSx~T�v��Z������o�=�PO�����A[�r�S�b����#��9a�zy���'>�Q7R�[�����}���m�Y�w
Behavioral task
behavioral1
Sample
Stellar-external.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Stellar-external.exe
Resource
win10v2004-20231215-en
General
-
Target
Stellar-external.exe
-
Size
5.8MB
-
MD5
469c8e03353d6710cdb1a330d1e517ca
-
SHA1
601dd081d3fc060948d024664b12f4da664d352a
-
SHA256
6d2fd18cad410c53b0fef9e0323cc4f05cfc77cd54ca6720a5833c84ba4f35fc
-
SHA512
750f9b2cd4e92a69b346489a58d935b56d445dd72a6c144c73021511527a73c4459ad34e3179bcba609271cdc71f567b7fde88362ff724746791826b0c15a0d7
-
SSDEEP
98304:ZS6+2Y5GFa6vl+ZHqVz+tsiuoiLxATv1O2g1rebJ6MA01BkdDOhmCqndsiAntyk:ZSGYWp4cdviuoJTdO2gZYb2dqcNndszt
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Stellar-external.exe
Files
-
Stellar-external.exe.exe windows:6 windows x64 arch:x64
194f29f479b16948583ad17512176960
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SleepEx
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXVec3Transform
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertFreeCertificateChainEngine
ws2_32
closesocket
rpcrt4
UuidCreate
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
fread_s
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-filesystem-l1-1-0
_mkdir
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
advapi32
CryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 821KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 945KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ