���P<CY����*�M�Ϸ{�L�R�g�-�g��I��N#��Bd/��_[�3�$&�7g3O�(�� ����LY�4���i����k%RbNOd���:I���D�j֩�2@��|C����̷e�}_�&�1��no���?�d���@�7N6�Eݰ��9�2U�G+:�,}�tu#�����2%?Sy���r��m5~n���Y��wzM���m��>��t�Y��X��L��\�d�4�g�7�im�Pg�vJ��&D*��ڇ��`�G�49ޤ�b ��⇒<mO�D��˥�������z�c�vu@�6q%��`'�(������e(V}zX�[a�^i/ �w�$�/�e��ns���<��{��p+7#��ߝ�;c�aC��>1~��Հ=�������#M���{�o�F�S+��Ry�b(�#�G`j�dp�r+4�����l�b�������ZN�F�� ����� ���eȍ��-�������$UQy2�k�4�w�n� L��w�� 3*7홶�M�!�9+�D�Ȯn��,7��/[���wՠ�98[J�F�����n�n�bU��d��1»��MS<�+o�C�J8�dA����Χ4��o ��� ��n;<N��s��;@�p������)z������V��>#9��-}��t�y�cP��[��Mߘ�i�Pc���(z����r�VI���CZ�����涤�o�n�j |����p[,��dw�R�c�1+��v�:Wz^�-D�UP�0�q`M���>�^�7�� �����v��Cx�>�2�Ҭ���8���=gL��t:���^�@���x�+, 0 �dϜ�U[�� V7��K�y2����xE�.jꢄf�R;u��Ōڝ�" ,ϲ]�@����H�榒�@�<A��Tnڊhe`�5����ݏ��ZX�C� ��,i��-����&1+uSS�4b�����q�D8-d��/Ɉ^�np�"�r6�%��4�Ť������i�p���Y��;�������# � �#T~���J�AJCM��ƯZڐfn�`�HFJ$s�-�1���\Fbv�˝�X��������CX�}��t�:�QSa�E�45ECFl���i��l��'tr7_q-ǗI�ޕ<�h����[|�����"�d��]��S�V�f;K<��{�gO+3������ga��8�RkʠLBE�.L~lSx�IW���rzv�yIk6ZGuP .?�����e��9�Uh��~ą��hiE����$�����ɯBq�Zr����gG"'x������'[p�IK�\�XM�8DQ/w�Nm�~C�V���>���ֈvр��2���d[~hD�]�Ȇ�Q�Z�@�p��)�P���t"�qr�5i�m��2L�Z���ɜy�Ov�����<��M�yT>��DQs�QJ`4^���|�W��K�о�i����b�������L:���H�ɾ�4��~(�\�VG����@c�*Y��>`�7J٘��UdǗw�Qt��$��.>�/�(x5\�����&�&L�����ȸ���̽2EO;�;�t�5������H�5�����>L�����_����8�����y$a|h�����{��� f-_U��`��������Bt�6���4�D0��{S�]F܀}�� $�,v�sQ��C�ɒ /tBro �*M;ʱ��m����~,k ���9"�f�����C�i�IǥZ��:�g?&���xVh�D6�!�bc�$<�x���2�s�V:{uX��D�����*+��]b����B(���s=�F=6��>�[�������]��a'8�PBxm�$C��F�.���i`���?��p`�9xg&NU���q�iѼ�A�j��Pӻ�E��e��=Y.�xf��L�F�AI��$E��Y����To�9x2�-Ȕ�s����8�>]�8`G]/4n��pWO�+��c�TV�"�, M�e�#3P����/i�7v�1��ʖ��$>�-̸�-����=�DK�� �*�8}W<F�O@��: "z��|(N;�92e��π�KGYH�n�t-��1��Mҽ6Ѫ����}��C(�%"Z�L�P9R%�zY;�5�l���,�^�4ҋ64��86m���<��D�9 YǶ�{YYj1���^|2����&��A�0��q���cz���L���C�O�TA��y�VQ�$���[$]h��i�k��0���Qi�A�0�HS���1�k�uO��%Oi���6�3��!w�0@{P �Y�Y�N6{�b�W8ΣJ�a�ޅ2)g��(��<q�7%亗NJ ���w'd�\��`i��]�TI͛�R5OAo��\C�G��Ί�F^��*o�[4d؋�ϖ�)_�& ��E��*i?�R��,���9}����CWR��~Wys`��^�7���j��a���̦j�a*��.�`�4H|9�YK�)1C�b�7�z� ,G�̂\9���.)�V�;�&�+�lA��_5�Ƅ.�ΐ��$x�{�5��(�4=��iz*I�XQ�M�)�]�RU�����y4l'EOƋ�h�;���������K;��^�)M��K�|cǚ�8�-8��f��a�ea�0 �B����Z�L ���Rq�˲U�g=���Hn��Y\�Ҙ��syL�8�������l���a��Nڰ6�W1�Ï�?̂ FQ�n����4�FP����qܶ"���An��=���w��O�|�i��~aL�/���(�9�������I���+��D�D�5� }����~5�k��HP� ^g�oX d:V>�9�!h�V���E��02[�:�5&��7�8�t'K-��T��,HM����Zk��/��z��^�z����wd���p��P��/��A1�S-��'Q�y�@�-����gm&�Bz�q�S�'�?��b��!/FH�G�R�[����w�՝�\{��{Sc]y����Y (���Z��L�b��送8.�n)�����UjS�mѹtߖ,�"K$0b8X��=%� ��+��݄�i�T�eض��\CN(3��Q)L7���4��< v�p/P�6� ��e�+�.���G��_0j�&����F��L��
Static task
static1
Behavioral task
behavioral1
Sample
AimStar-CS2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AimStar-CS2.exe
Resource
win10v2004-20240226-en
General
-
Target
AimStar-CS2.exe
-
Size
5.8MB
-
MD5
456d0238e4e270891082535692a8c4c5
-
SHA1
a40ad64a7a2e60bc2fa32e131db4e0e50345e04e
-
SHA256
388f08c735e7e785113efe5091e40903e171bc482a0098892f9f792e921a8f0d
-
SHA512
88b411787daedcb22c8740d66ce90122372ff2dc6ea9d6e0ec09bf30788758999241bc6409365ad6f5c3ed91c71e4f86ee37eff2c531b0324d4593acace36714
-
SSDEEP
98304:bEmJw6mNOljVyW+O/Qe4gNZ0IJSpj0sQmheAliYupI+uwdzvuDX2vzOrlX0z6u:l+2ljV/x/QeNNZ1JSmsghIVDX2vWl0zl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AimStar-CS2.exe
Files
-
AimStar-CS2.exe.exe windows:6 windows x64 arch:x64
83b40b036c9dd2c9632729b3d20e4205
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
_Query_perf_frequency
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmGetContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
cos
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 755KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.000 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.001 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ