Celestial_Rat.rar
- SHA256 1001fdf77dfa3f34ae1a7e6d32776dcdd94365dc4785a8b82e96834c9d0f60bd
Overview
overview
7Static
static
7Celestial_Rat.rar
windows11-21h2-x64
3Celestial ...al.exe
windows11-21h2-x64
7Celestial ...er.exe
windows11-21h2-x64
7Celestial ...or.dll
windows11-21h2-x64
1Celestial ...pf.dll
windows11-21h2-x64
1Celestial ...ib.dll
windows11-21h2-x64
1Celestial ...et.dll
windows11-21h2-x64
1Celestial ...6c.dll
windows11-21h2-x64
1Celestial ...8c.dll
windows11-21h2-x64
1Celestial ...sm.exe
windows11-21h2-x64
1Celestial .../d.exe
windows11-21h2-x64
Celestial ...ow.dll
windows11-21h2-x64
1Celestial ...eo.dll
windows11-21h2-x64
1Celestial ...ip.dll
windows11-21h2-x64
1Celestial ...GI.dll
windows11-21h2-x64
1Celestial ...11.dll
windows11-21h2-x64
1Celestial ...D9.dll
windows11-21h2-x64
1Celestial ...DX.dll
windows11-21h2-x64
1Celestial .../m.exe
windows11-21h2-x64
1Celestial ...sig.py
windows11-21h2-x64
3Celestial ...ib.dll
windows11-21h2-x64
1Celestial ...ib.dll
windows11-21h2-x64
1Celestial ...er.exe
windows11-21h2-x64
1Celestial ...rt.bat
windows11-21h2-x64
1Celestial ...art.sh
windows11-21h2-x64
3Behavioral task
behavioral1
Sample
Celestial_Rat.rar
Resource
win11-20240508-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Celestial Rat/Celestial.exe
Resource
win11-20240508-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Celestial Rat/CelestialPatcher.exe
Resource
win11-20240426-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Celestial Rat/IconExtractor.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Celestial Rat/Notifications.Wpf.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Celestial Rat/Vestris.ResourceLib.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Celestial Rat/WinMM.Net.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Celestial Rat/data/6c.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Celestial Rat/data/8c.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Celestial Rat/data/asm.exe
Resource
win11-20240419-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Celestial Rat/data/d.exe
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Celestial Rat/data/libs/AForge.Video.DirectShow.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Celestial Rat/data/libs/AForge.Video.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Celestial Rat/data/libs/DotNetZip.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Celestial Rat/data/libs/SharpDX.DXGI.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Celestial Rat/data/libs/SharpDX.Direct3D11.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Celestial Rat/data/libs/SharpDX.Direct3D9.dll
Resource
win11-20240419-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Celestial Rat/data/libs/SharpDX.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Celestial Rat/data/payload/m.exe
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Celestial Rat/data/payload/sig.py
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
Celestial Rat/dnlib.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Celestial Rat/scripts/ClipperLib.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Celestial Rat/server/Server.exe
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Celestial Rat/server/start.bat
Resource
win11-20240426-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
Celestial Rat/server/start.sh
Resource
win11-20240426-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target Celestial_Rat.rar
- Size 13.1MB
- Sample240523-pnf3bahf97
- SHA256 1001fdf77dfa3f34ae1a7e6d32776dcdd94365dc4785a8b82e96834c9d0f60bd
- MD5 30496f3a3ebd66dd1e1a9c98f0c2972c
- SHA1 40571b3491c032ab1c28ebc24859a0d01300fafe
- SHA512 ba6fb9e5b555b20c5d0c14ab209890948982849d3da4bc0f336db1b3baf7d212e50b8ca6a1db89fc2679eb008021e9651b4795ea6990fc2b9915c8156695ec5f
- SSDEEP 393216:uoUU21bSb/2r7fIKXX/XapCaNtmWGTpVlPchk5k:uoUnFDfXitmWVv
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Celestial Rat/Celestial.exe themida - Unsigned PE 18 IoCs
Checks for missing Authenticode signature.
resource unpack001/Celestial Rat/Celestial.exe unpack001/Celestial Rat/CelestialPatcher.exe unpack001/Celestial Rat/IconExtractor.dll unpack001/Celestial Rat/Notifications.Wpf.dll unpack001/Celestial Rat/Vestris.ResourceLib.dll unpack001/Celestial Rat/WinMM.Net.dll unpack001/Celestial Rat/data/asm.exe unpack001/Celestial Rat/data/libs/AForge.Video.DirectShow.dll unpack001/Celestial Rat/data/libs/AForge.Video.dll unpack001/Celestial Rat/data/libs/DotNetZip.dll unpack001/Celestial Rat/data/libs/SharpDX.DXGI.dll unpack001/Celestial Rat/data/libs/SharpDX.Direct3D11.dll unpack001/Celestial Rat/data/libs/SharpDX.Direct3D9.dll unpack001/Celestial Rat/data/libs/SharpDX.dll unpack001/Celestial Rat/data/payload/m.exe unpack001/Celestial Rat/dnlib.dll unpack001/Celestial Rat/scripts/ClipperLib.dll unpack001/Celestial Rat/server/Server.dll
File Explorer
-
Celestial_Rat.rar.rar 13.1MB
-
Celestial Rat/Celestial.exe.exe 9.4MB
-
Celestial Rat/CelestialPatcher.exe.exe 3.6MB
-
Celestial Rat/IconExtractor.dll.dll 10KB
-
Celestial Rat/Notifications.Wpf.dll.dll 24KB
-
Celestial Rat/Vestris.ResourceLib.dll.dll 76KB
-
Celestial Rat/WinMM.Net.dll.dll 43KB
-
Celestial Rat/data/6c.dll12KB
-
Celestial Rat/data/8c.dll10KB
-
Celestial Rat/data/RT.bin191KB
-
Celestial Rat/data/RTS.bin161KB
-
Celestial Rat/data/asm.exe.exe 1.2MB
-
Celestial Rat/data/d.exe3KB
-
Celestial Rat/data/injector.bin179KB
-
Celestial Rat/data/libs/AForge.Video.DirectShow.dll.dll 60KB
-
Celestial Rat/data/libs/AForge.Video.dll.dll 20KB
-
Celestial Rat/data/libs/DotNetZip.dll.dll 448KB
-
Celestial Rat/data/libs/SharpDX.DXGI.dll.dll 125KB
-
Celestial Rat/data/libs/SharpDX.Direct3D11.dll.dll 271KB
-
Celestial Rat/data/libs/SharpDX.Direct3D9.dll.dll 338KB
-
Celestial Rat/data/libs/SharpDX.dll.dll 247KB
-
Celestial Rat/data/payload/m.exe.exe 101KB
-
Celestial Rat/data/payload/sig.py10KB
-
Celestial Rat/data/stub.bin170KB
-
Celestial Rat/dnlib.dll.dll 1.1MB
-
Celestial Rat/log.txt55B
-
Celestial Rat/scripts/ClipperLib.dll.dll 6KB
-
Celestial Rat/server/Server.deps.json1KB
-
Celestial Rat/server/Server.dll.exe 77KB
-
Celestial Rat/server/Server.runtimeconfig.json1KB
-
Celestial Rat/server/net8 linux install.txt217B
-
Celestial Rat/server/start.bat37B
-
Celestial Rat/server/start.sh31B
-
Celestial Rat/sound.wav71KB
Celestial Rat/Celestial.exe
- SHA256 4a9d64583260db1c1e4ff7d763341a1ab2bdf1d6e840dd622efad07da12a1d32
- MD5 86cae458b120a8c8f336d30590cc3c4f
- SHA1 68f0a11a37c01f79db978ef19c03ee9c3457a6db
- SHA512 489eb0bc1d465c713e4670a2743499ed256bd535332e211fd37f900f3d4a707c35d9dbee391e33d07eb4a9421f4312f74ecaf924f0b86ddecfe4190186093dbb
- SSDEEP 196608:8o/0CasEDPZ2lB54SY3KTBRYIzH7IXB0wnlnmELgaJitOsFo:8o/TTAPcf5Bqa3zzH7IB00nn4OsFo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.themida
Size
9.2MB
Virtual Size
9.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
264KB
Virtual Size
263KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Celestial Rat/CelestialPatcher.exe
- IMPHASH d341ecf5263ee0002cca002652f0c62c
- SHA256 02ac9261c1588b3d464c112cc34b4b29e315ec9f0c2d305f6d8567fc92bd9b90
- MD5 ee61359e7e1ceaed2a297f66baa7c7fc
- SHA1 01e5940c52ca2db5c295fd4865f2db9bfa720653
- SHA512 1a6bfe99e0289c7e9e964386a6776b7ceaee6fc13ee2fae7d21bc28a766ee2f0b8329cad4edcb92f8254374dd13fe7450029e6020f9fc6456f6fd771fd142006
- SSDEEP 49152:xBusENBlYwQpOOkr5rWM9ZlVvcAAOdVGlBRSfkRnuocIa9Z41hzugG7:qHpZ1lVv0OjGvRSoeIZzuR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
397576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Adminus\source\repos\CelkaPatch\CelkaPatch\bin\Release\net8.0\win-x64\native\CelkaPatch.pdb
advapi32
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
bcrypt
BCryptGenRandom
kernel32
TlsFree
TlsSetValue
SetLastError
FormatMessageW
GetLastError
OpenProcess
CloseHandle
GetCurrentProcessId
GetCurrentProcess
IsWow64Process
ReadProcessMemory
WriteProcessMemory
QueryFullProcessImageNameW
VirtualAllocEx
VirtualFreeEx
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
SuspendThread
ResumeThread
OpenThread
CloseThreadpoolIo
MultiByteToWideChar
GetStdHandle
RaiseFailFastException
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetTickCount64
GetCurrentThread
Sleep
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
QueryPerformanceCounter
InitializeCriticalSection
InitializeConditionVariable
WaitForMultipleObjectsEx
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
QueryPerformanceFrequency
GetFullPathNameW
GetLongPathNameW
LocalAlloc
GetConsoleOutputCP
WideCharToMultiByte
GetProcAddress
CreateIoCompletionPort
CreateDirectoryW
CreateFileW
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
DeleteFileW
DeviceIoControl
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
FreeLibrary
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetModuleFileNameW
GetOverlappedResult
GetSystemDirectoryW
LoadLibraryExW
ReadFile
SetFileInformationByHandle
SetFilePointerEx
SetThreadErrorMode
CreateThread
DuplicateHandle
GetThreadPriority
SetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
GetCurrentProcessorNumberEx
SetEvent
CreateEventExW
GetEnvironmentVariableW
GetExitCodeProcess
CreateProcessW
K32EnumProcesses
GetProcessId
CreatePipe
GetCPInfoExW
GetConsoleCP
GetConsoleScreenBufferInfo
GetConsoleMode
ReadConsoleW
SetConsoleTextAttribute
WriteConsoleW
FlushProcessWriteBuffers
GetCurrentThreadId
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
TerminateProcess
SwitchToThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
ResetEvent
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
InitializeSListHead
ole32
CoTaskMemFree
CoWaitForMultipleHandles
CoTaskMemAlloc
CoGetApartmentType
CoInitializeEx
CoUninitialize
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
_callnewh
_set_new_mode
api-ms-win-crt-math-l1-1-0
modf
pow
ceil
__setusermatherr
api-ms-win-crt-string-l1-1-0
wcsncmp
strcmp
_stricmp
strcpy_s
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
abort
_initialize_wide_environment
terminate
_crt_atexit
_seh_filter_exe
_set_app_type
_configure_wide_argv
_register_onexit_function
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_initialize_onexit_table
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
DotNetRuntimeDebugHeader
Name
.text
Size
409KB
Virtual Size
408KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.managed
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
hydrated
Size
Virtual Size
487KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=261, version=32533,
count=12, id=260, version=32533,
count=9, id=259, version=32533,
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=243, id=1, productName=Unmarked objects,
count=9, id=259, version=32824,
count=1, id=260, version=32824,
count=1, productName=Unmarked objects (old),
count=62, id=261, version=32824,
count=1, id=256, version=32825,
count=1, id=258, version=32825,
Celestial Rat/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/Notifications.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 26bf458ea96d09e78d9ac1200d2156d9e620e0fec1bda2e7eac6b05c62eb2677
- MD5 f30ef05b403132ea4a9949be8c82f94a
- SHA1 7f6d2d05e5f126a51490af987430d58a80417e45
- SHA512 2bbcf7ec87e4a8ca933116ce86c8f15f98c74c103bdd31f6b55e264bfc07e492aa4b2c271efe7d7dce7e90df882f15de5f26af9ff0137350717ff1c91d0e0059
- SSDEEP 384:OGzTcjcYCjLO0dBjEQu1NjEVXVfLo9yUEwzjVu9e6134xrZtKN8a9dGg/UzZH:tzAjchPOMj21NAPMjQTMXgMzZH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\08fed\OneDrive\Dokumenty\Visual Studio 2015\Projects\Notifications.Wpf\Notifications.Wpf\obj\Release 4.6.1\Notifications.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/data/6c.dll
- SHA256 b28ddbb286527291c3d975c1d12f48cdeafc4112f1dd0f4705bd78c45089e602
- MD5 3ec6489c7f7cda436d731c7a725d1c78
- SHA1 ee1da7a411b3206176f3d84e6dc2765e439bc5f9
- SHA512 95f3475bee34f355a217cb67e06544b046edd282e453a5845ae0055026c23f2fea8206079cee0c194cd447e8a8253cd66fa65c52bbb4963c44f31660ef987e9e
- SSDEEP 384:3qv40ttXlAm9HPgtSy+0r+7E3j9noVpOsocd8:6w8tOm9HyC0r+e5qnq
- MD5 SHA1 SHA512 SSDEEP
Celestial Rat/data/8c.dll
- SHA256 ed987fd6e7270750ca409d2c7a6a83df19c859655bc0f6280052a80a3b73019e
- MD5 1c5f3af3deceee48756e8cd0e025bd4f
- SHA1 856ac39e4a19fd4e3cfe43fe5ab6209e7171dc98
- SHA512 afa1c5c6d698c1b26789a5c30f097baebccda1eaaa46ff49129810c6b2d5795cb76be5f910f4ffcc4ae68f187ba97547829e9c57bc6b7f634be21d282f3e0ed0
- SSDEEP 192:GYilGQQCC/dLo8i1/q8Lz+iGwo78IYnp7RKWPfAVx9yufgb84XyJ6tVW527o:GYilGzZdLoTri74p70lQtX/t852s
- MD5 SHA1 SHA512 SSDEEP
Celestial Rat/data/RT.bin
- SHA256 b0f1c9b0e3fdfe50eb80dd3211f2b7cd803735232b486c54527e7a8fcd88cc72
- MD5 dd2931da2004398bff3ce4fd7c060e3d
- SHA1 0a5abd450045bc932a4ca04f502501c696f2b3d5
- SHA512 a64f0be7a332044adfce86dd5e23340b5d94336c9cfc275dd873d43d9313db05383a7a6d8f844f1da238dc8b81d3d7217121fba1edb3b3d63b4035382c5d2714
- SSDEEP 3072:6NEbsYfrCHe4AsJIl4aBbuxDGmc8bVzyHyVZqLz8uywsX+Cheeu/5vHmepn2tiKa:vY97JIvbgFcqgyVG8uzi+ce9vGepnMiB
- MD5 SHA1 SHA512 SSDEEP
Celestial Rat/data/RTS.bin
- SHA256 c46dd46cfe5ffe1939b899fc9c83dfd08f00ec879f3b446bac7d8e0c7f477af4
- MD5 f1e39bb173fb430555533020e44da6fb
- SHA1 a82577d4a67860b8f51b570d9c262fe0de364f2c
- SHA512 b132fa047f834cd2162a82c20ac964005991e90710117e5e03f943b4d9fb3a0e45ec6782395beb0ac2048fdd9205f0041a31657a8170305c4196c0d8466f6e4c
- SSDEEP 3072:8/Y2ISF+F/KFG17skd2SI/4rZ4EWDGG2su3SVhndbmJ6XaDlcwwnTIP:8TkFyU7X2r/g43DusBuwXw8IP
- MD5 SHA1 SHA512 SSDEEP
Celestial Rat/data/asm.exe
- IMPHASH 245fd5847db29ac01003e87f2fc0fe30
- SHA256 442f6f984804c2e08c151f5565c2fdddda3a899d8e380512f271a3edbbf34cb4
- MD5 288f2be6334f4ea09abf3209166f9ac1
- SHA1 c6c613aea50ee2f51518b2e5e0e1041ee101beb5
- SHA512 470ad18548d290bfbe4de768258ac6fc0863d28f4ad5bd8d169cff0d84f1326fb33351c5549c8f888258a7226ad8701ec2d913a8de300a96333403d60a510baa
- SSDEEP 12288:dzMVtmYR2GGsxc7rjzWzzEqGc3I/Iga5/:dQCYEGGsxcvjzWX5/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__C_specific_handler
__dllonexit
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_chsize
_errno
_filelengthi64
_fileno
_fmode
_fullpath
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_onexit
_stat64
_stricmp
_strnicmp
_time64
_unlock
_vsnprintf
_write
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getenv
isalnum
isalpha
isspace
isxdigit
malloc
memcmp
memcpy
memset
perror
printf
putc
puts
qsort
realloc
remove
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strtoul
tolower
toupper
ungetc
vfprintf
_fileno
_access
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
876KB
Virtual Size
875KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Celestial Rat/data/d.exe
- SHA256 b633090055b97c0f1055d4c222541bda19a7a886b2a1f173f484b724b04fbbcc
- MD5 4f4191c7dc87491545cbf31ed2e6a67f
- SHA1 8a5dd92b1608a9e77ef96804da03cdf3ea49037d
- SHA512 2e41d5710ce1012943b8db6461f9117ce67643b19d150ee52ca0c0be149f089a36697b142107704b1a4c975ce1b06303c89186afaa984ddcbf24b3d0331dc505
- MD5 SHA1 SHA512
Celestial Rat/data/injector.bin
- SHA256 9dc83ef7efc080f6825a9d4ddaf33a1dc08892ce1f55b436cce67b471fdeae51
- MD5 9ddea867f7de40b586d0b9e76029d675
- SHA1 69d4a9a32914b3755442cb3dafe86dc15f398ca0
- SHA512 faf04073e5f0aa2a70c46a88f24c8f6c86634328c8c3c58788e2f582d42dfd6ed5c97855b7ea5bcdcb92136b1a3355ce2c93b220a77a044a9075d551204ff549
- SSDEEP 3072:ooiIoJM87G+RSfTnxkcmhtSKqkH0oG3WlCrGKPoxmsQPNApTPO3/w2PR9lR3Lets:ooiIAaMqnDLkHwuMixmsSAA3bj3L6hL2
- MD5 SHA1 SHA512 SSDEEP
Celestial Rat/data/libs/AForge.Video.DirectShow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
- MD5 17ed442e8485ac3f7dc5b3c089654a61
- SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
- SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
- SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
67246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb
mscoree
_CorDllMain
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/data/libs/AForge.Video.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
- MD5 0bd34aa29c7ea4181900797395a6da78
- SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
- SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
- SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Andrew\AForge.NET\trunk\Sources\Video\obj\Release\AForge.Video.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/data/libs/DotNetZip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 00da1597d92235d3f84da979e2fa5dbf049bafb52c33bd6fc8ee7b29570c124c
- MD5 6d1c62ec1c2ef722f49b2d8dd4a4df16
- SHA1 1bb08a979b7987bc7736a8cfa4779383cb0ecfa6
- SHA512 c0dce8eaa52eb6c319d4be2eec4622bb3380c65b659cfb77ff51a4ada7d3e591e791ee823dad67b5556ffac5c060ff45d09dd1cc21baaf70ba89806647cb3bd2
- SSDEEP 6144:FuCIjOL8qwWN/jMlC/XiapWSu9vnITVxGtSV41kJDsTDD5rlGe6wfxLV/7:dZLJLdvOSsnjS4csBrge6sf7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
453046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb
mscoree
_CorDllMain
Name
.text
Size
446KB
Virtual Size
445KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/data/libs/SharpDX.DXGI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
- MD5 2b44c70c49b70d797fbb748158b5d9bb
- SHA1 93e00e6527e461c45c7868d14cf05c007e478081
- SHA512 faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0
- SSDEEP 1536:taSL4xpOaI0PXSgMkPXsHIrPQkrNCivO5Ib6VU3x8w85SMxcnqNojG5JW/UlibAs:taSLYpfI0fTtP8HIbQkreK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
134238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX.DXGI\bin\Release\SharpDX.DXGI.pdb
mscoree
_CorDllMain
Name
.text
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/data/libs/SharpDX.Direct3D11.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
- MD5 98eb5ba5871acdeaebf3a3b0f64be449
- SHA1 c965284f60ef789b00b10b3df60ee682b4497de3
- SHA512 a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2
- SSDEEP 3072:6ccUvNf/AThDrcfiSDt0XN3ZDoyz91Sy0KwbwgG5OHDyGQsnHZ09K3vJqlQ1VcTS:zRfi+SmNgOHDyGQsucvJqW6Ts4dDjJZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
283726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\desktop-duplication-net-master\desktop-duplication-net-master\libs\SharpDX.Direct3D11.pdb
mscoree
_CorDllMain
Name
.text
Size
269KB
Virtual Size
269KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/data/libs/SharpDX.Direct3D9.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
- MD5 934da0e49208d0881c44fe19d5033840
- SHA1 a19c5a822e82e41752a08d3bd9110db19a8a5016
- SHA512 de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59
- SSDEEP 6144:sF8TUNl4RaWH/EgJ2bOVbIbgiSC0EhS/:+8laWsgOOQHS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
352142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX.Direct3D9\bin\Release\SharpDX.Direct3D9.pdb
mscoree
_CorDllMain
Name
.text
Size
336KB
Virtual Size
335KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/data/libs/SharpDX.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
- MD5 ffb4b61cc11bec6d48226027c2c26704
- SHA1 fa8b9e344accbdc4dffa9b5d821d23f0716da29e
- SHA512 48aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9
- SSDEEP 6144:/yx2FKVw+6LRnencMdWqtFhdpGFfnbJoeeYr:6w+Ienc1qf6bJrd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
258638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX\bin\Release\SharpDX.pdb
mscoree
_CorDllMain
Name
.text
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/data/payload/m.exe
- IMPHASH 51e7ef6b1d43d0d05d7109dee9789560
- SHA256 2852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
- MD5 8b632bfc3fe653a510cba277c2d699d1
- SHA1 d6a57aa17e5eb51297def9bac04e574c1e36d9c7
- SHA512 b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
- SSDEEP 3072:S0+mlNniJkkKcfqBOb65VgB183gUGQ340HpL:SvmlNn4kkeOAVA1rUGh0Hp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
225455
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
imagehlp
CheckSumMappedFile
Name
.MPRESS1
Size
88KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
1024B
Virtual Size
862B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Celestial Rat/data/payload/sig.py
- SHA256 9f9de3fed2a5096064400ca82f724d0a3579ddddd952802a9b0b7090e3a67ebf
- MD5 d3fb7ea2605ea11bffcc182c2a04a05c
- SHA1 db7c73078f5e1d3272641aa850ae498bcc0d1aec
- SHA512 7c0914063bf1d38f3a0b91038cb6719dd243160ea418dfa7e478fe45cc6f00b0afecf7664394be4b4ff17bfed552eb8d12437106a23a6fbc816fbb0800caa2b9
- SSDEEP 192:k5dsG6l63D/uIiYi+gV6EfowUMB1N1d11TqmSe9aF:kN/myab11Oh
- MD5 SHA1 SHA512 SSDEEP
Celestial Rat/data/stub.bin
- SHA256 345752e57fc77cb500889caf2a77c1d2769b34fb871775ed271a8038eee2cfea
- MD5 26891bbe20e128a60c6867c473994a23
- SHA1 67169e23275a5cbfbe181afcd428a739e6c58eb7
- SHA512 f1a87c77a0e8b0aced053d8fd864ed9dfdd4f311c81b93b08c0d4db691ed14353cb1628590e128368df653154e16f81edfa2f234fc6f05204034c9d63e16271c
- SSDEEP 3072:t9rHn3lYxzddndzP/SgN9lcfzgWEduNXx+wBNlTiytkttV9rNLl2NI:jjnuDdnV/llccWESXxZ1k3NLl2i
- MD5 SHA1 SHA512 SSDEEP
Celestial Rat/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 83445595d38a8e33513b33dfc201983af4746e5327c9bed470a6282d91d539b6
- MD5 de0069c4097c987bd30ebe8155a8af35
- SHA1 aced007f4d852d7b84c689a92d9c36e24381d375
- SHA512 66c45818e5c555e5250f8250ea704bc4ca32ddb4d5824c852ae5dc0f264b009af73c7c1e0db1b74c14ee6b612608d939386da23b56520cac415cd5a8f60a5502
- SSDEEP 24576:m+pL+hwfQvqx+yLjynb1YNzh/CNX7fegPeH3hid3Hc9ZEu5DkU6FPepU1VWv7fo0:sxvCLUJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1152126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\dnlib\dnlib\src\obj\Release\net45\dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/log.txt
- SHA256 69f2142465f8a240251ca440cfd441e36faef6b5045e2ee69edcd22acd3dac58
- MD5 4a41a1d14ed1979a306ea45225a1c021
- SHA1 e781564a8cc521c4a331b79da4d78f5367e8cdd6
- SHA512 5b1f165e1e939d254937428c8e235f045459593ad4cbe66ef3cf63f6f86eecdf0585670cd4695400515c716ab0dafc6bda65ca61f66dd030d0e8472d7c70e3e5
- MD5 SHA1 SHA512
Celestial Rat/scripts/ClipperLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 37f5ae278214418b8b446db0b7bc73d523fcb33ab06858dcc032df52c2e42bc0
- MD5 5808a2d5f26fed3bba87215814269441
- SHA1 55f22333b297eac7b3cee9926102f1813fcb6c80
- SHA512 947a43c7f5bce7d693505c0a1f27ff3d91613671b2cbc5a2cedd2404c01ad413861f7d10aa82f2de613138862572c9d8453ed4dc1c15fd22f42ca1ed91f3734e
- SSDEEP 96:UhmExmvTk9dBqY+TQbzpfVD2qe5ombWnRVVvQklmOez:UhLx1h4QblhIomKVVvJP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Michigun\source\repos\ClipperLib\ClipperLib\obj\Release\ClipperLib.pdb
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Celestial Rat/server/Server.deps.json
- SHA256 dfcbd4d1464f93a25716cfaf52ea42144cb0b1ce111c83d1735ba443c2ad7df5
- MD5 54072cd6974a8426b2e0bbfb5ee07199
- SHA1 cd43434ca1eac9f93beda1c4a09e7e643e9ba522
- SHA512 8ebde48c27fa44d0b6ac388b6720a19b994c566938aeffa8163b53f11f94a43f8be91108fd2d7fcdc170a558a0fafe0c1fade28ddac73baf881a446a095ada84
- MD5 SHA1 SHA512
Celestial Rat/server/Server.dll
- SHA256 cbddd8650c3bb5ccc914c36746a72c3659fe74f42fd938007ce17fbc153079d5
- MD5 f4ca6c347e85f747ffd1056021fe687f
- SHA1 c7f655075814e56daa7f4f037f09a37c7d07576d
- SHA512 1d5def74f59a7a982b85ef5406793d28271125085e7d5eddefe353d46b2852fb4ad3c1a74bbaac93d30a75de1c19e8fbf5a6adb7cf3487b93445b69d60f1714f
- SSDEEP 768:o/uxpziDy3VP7YQ4E822l+GkgDPY0TZyWOnZQF25u7E+hbTYSqMdZd:owziDMVzvJ++ngDPY0TZ10WAY7BcEZd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Celestial Rat/server/Server.runtimeconfig.json
- SHA256 5902ca5deeb7dea0cbf33c7a5cb8c94e4fba948986dac89e4c1ea236644bfaca
- MD5 85c6a84999cce968cfe76203e42b3b21
- SHA1 c71ddb848dacdd775b6afc552028f6dd931c13cc
- SHA512 3986ea2c4f5c7171d4268575dc62412ce38402167ed0619b423bbf9669089c3441b01f2fc6d8cfb0d3f3d395bf0fa3d7f9dcce3db7f04df59122b4d61392f329
- MD5 SHA1 SHA512
Celestial Rat/server/net8 linux install.txt
- SHA256 12cd84fa2bfbecfc66d3d826777387af1dd507cf826219e1d90d8ae45ee0e971
- MD5 ef9db176ca867a0cbf23a2cee4dc0e91
- SHA1 7a19baa444b4e13ad74c6a4ff1e209549582d832
- SHA512 a7d2640fa3acab89ad787aa1b709c9d848b8c025ea974be6e4978502c9a38e376c8b017d3b892bdb92e3e9cd424ac6425cd78a49197b5231964cc196f590862c
- MD5 SHA1 SHA512
Celestial Rat/server/start.bat
- SHA256 409dffb5444c2630541f7d539effeeae3df3ed993b4dba2a5e60d8940548b1d1
- MD5 4d04aeb048cd4e89bf1b6718824ec5a2
- SHA1 621e1ae4a7d7901e34e61f6e7fa90b8ad89af0de
- SHA512 99c18b9c6a397c4033a2dde8fdc1fa13b9d5a685d50548358651d617c42b059b8f772d7e34dc1769ae546e11229b19185a4fd93ce2753567ead51a999365fb40
- MD5 SHA1 SHA512
Celestial Rat/server/start.sh
- SHA256 b5cdc6104a9d576c35234153d4658fed1e152dc4044064ca1af376d88e254b92
- MD5 e61025394a091067d696d9bad73ee4ac
- SHA1 1332dde20433eb1415c416f0281a884bcdf2890f
- SHA512 921df7058d7fc535e2d72c14922e860e3944318cb0d7734f122a782e73272b4b2dd79ec62b2025c30012a984a6798c3e7873be38ebc2410bef191e9787ef1328
- MD5 SHA1 SHA512
Celestial Rat/sound.wav
- SHA256 c2ef64e42ff0309ab1c9b9c010133ee5c24788f28a5ea60f59dbf79ce79de56f
- MD5 972f176f68c9c88b5156e0dbc057a355
- SHA1 2aa283821397b91c10589b85a75a5a78458e70d9
- SHA512 20afc1ed76b18d859023fe92e5aa86b8715ea4156578481e0580d44ab1dc0766243e929c28dfbef00f81b8be0d5a472222466703f8471f5b81591f797c815d55
- SSDEEP 1536:bESb6cWyjpgo4nV+okk4GtaxIy93qJfpa9Pu6cY:gG5QV+ok6taxIxH6c
- MD5 SHA1 SHA512 SSDEEP