General

  • Target

    Celestial.zip

  • Size

    84.0MB

  • Sample

    240612-3adlxsvcmg

  • MD5

    3d97d5efb67de7470ce3607c26b292e4

  • SHA1

    4b14f103c0b9c5ad2e4dd4c13c58ed8483fefed1

  • SHA256

    e77f9b875a25dcbfbb45c2f2eaf3d1b488fdb2f5cba434f8d5ce7737b3579435

  • SHA512

    1546c56ab87d9086dc5849ebe4954cf798ffca1ed79c17c733b4f688611f412d1c40e15bbd159b243c320c28a2fc3ccecfba20c85d1a84c86929605985e62eb5

  • SSDEEP

    1572864:ac237cKVO98odr456yGbuxapkkC1DszA8dkBUISvNC1qDhkBuKQO1VwBZtOBI:ac8ISw456yQuYpkqN+BkBZtOBI

Malware Config

Targets

    • Target

      Celestial.zip

    • Size

      84.0MB

    • MD5

      3d97d5efb67de7470ce3607c26b292e4

    • SHA1

      4b14f103c0b9c5ad2e4dd4c13c58ed8483fefed1

    • SHA256

      e77f9b875a25dcbfbb45c2f2eaf3d1b488fdb2f5cba434f8d5ce7737b3579435

    • SHA512

      1546c56ab87d9086dc5849ebe4954cf798ffca1ed79c17c733b4f688611f412d1c40e15bbd159b243c320c28a2fc3ccecfba20c85d1a84c86929605985e62eb5

    • SSDEEP

      1572864:ac237cKVO98odr456yGbuxapkkC1DszA8dkBUISvNC1qDhkBuKQO1VwBZtOBI:ac8ISw456yQuYpkqN+BkBZtOBI

    Score
    1/10
    • Target

      Celestial.exe

    • Size

      84.0MB

    • MD5

      0e98e512ac1515784a6269c7d937969c

    • SHA1

      1acee28be7e518186e132d51d2e6f9af5de40127

    • SHA256

      8d9235f95e2e8cbeb94aab443a4a377488c48d5d08f432e8f6298886e72a7e93

    • SHA512

      e39c95aa2dc2d0e7eaf7832737fd04eabcf45390f7725f542ef74462a4b186856c3b6548d31aec53a16fc7a43dc81c8338615a2f4ec561476a0c7b7f2d6bd0e2

    • SSDEEP

      1572864:t4gPXMoB23K8/dGjCHtc8ZMRAKSl9S9I698t6EmBp692FVSh6gCIP1G9vVKG7:t4AcWmGjCHtc82RAgDkhQ9vVKG7

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    • Target

      $PLUGINSDIR/app-64.7z

    • Size

      83.7MB

    • MD5

      3ea87576bf5faace7ddb9d21d14994af

    • SHA1

      42ec62b1bf2f7489630d2e4111af8cc35d120d35

    • SHA256

      cd50b7802e58b465d97dd28073465de1b435140f59641cad05c437eaf75faaea

    • SHA512

      3440f1a59df6b0d56da75b1929e0836556b25ae3dcc26fba7d35dc49b9ca0e385f923f0d7f2d10c12568b292cb04faba0a90928b6f7a1e712b9c953f0c582295

    • SSDEEP

      1572864:94gPXMoB23K8/dGjCHtc8ZMRAKSl9S9I698t6EmBp692FVSh6gCIP1G9vVKo:94AcWmGjCHtc82RAgDkhQ9vVKo

    Score
    7/10
    • Executes dropped EXE

    • Loads dropped DLL

    • Target

      LICENSE.electron.txt

    • Size

      1KB

    • MD5

      4d42118d35941e0f664dddbd83f633c5

    • SHA1

      2b21ec5f20fe961d15f2b58efb1368e66d202e5c

    • SHA256

      5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

    • SHA512

      3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

    Score
    1/10
    • Target

      chrome_100_percent.pak

    • Size

      132KB

    • MD5

      a0e681fdd4613e0fff6fb8bf33a00ef1

    • SHA1

      6789bacfe0b244ab6872bd3acc1e92030276011e

    • SHA256

      86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2

    • SHA512

      6f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196

    • SSDEEP

      3072:tezwJCGIekwf9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:tezw1Iek+42k3yMK18Gb0OV8ld0GecQJ

    Score
    3/10
    • Target

      chrome_200_percent.pak

    • Size

      190KB

    • MD5

      c37bd7a6b677a37313b7ecc4ff01b6f5

    • SHA1

      79db970c44347bd3566cefb6cabd1995e8e173df

    • SHA256

      8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a

    • SHA512

      a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb

    • SSDEEP

      3072:ADQYaE/N6Mrvy/3JP29W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ADQYaSN6svyd242k3yxgx5GMRejnbdZR

    Score
    3/10
    • Target

      icudtl.dat

    • Size

      10.2MB

    • MD5

      e0f1ad85c0933ecce2e003a2c59ae726

    • SHA1

      a8539fc5a233558edfa264a34f7af6187c3f0d4f

    • SHA256

      f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb

    • SHA512

      714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28

    • SSDEEP

      196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I

    Score
    3/10
    • Target

      locales/af.pak

    • Size

      447KB

    • MD5

      917a688d64eccf67fef5a5eb0908b6d4

    • SHA1

      7206b01bbc3fd8cc937db9050dd8ac86cf44d8cc

    • SHA256

      6981249837ad767fc030edc8838878a5e493fb08cc49982cffaed16cfbeb564d

    • SHA512

      195dbec8463cf89990232296c5c927e1501f0c2e01a7be7c6a6acae651853ce1edb23d639af65979b39a3c61979119c3a305acfa3aadf0cb93e241c5e57f4534

    • SSDEEP

      12288:/cqYYWk0o+wZiSMKVQ2uM2Z12JynA7PIrfsdgSTCSQ2fs37KQOb5t/tn6A/HiaHU:ynk0ofMSMaTuM2Z12JynA7PIrfsdgST4

    Score
    3/10
    • Target

      locales/am.pak

    • Size

      727KB

    • MD5

      3cfd7c5bb92ab72c63e003208a9e4529

    • SHA1

      165d2f69ab6a6e237f0fec943b5577123cefea87

    • SHA256

      12e9e1bec1c46e5ea706157726e17a4429acf288a5754fa183bd9b4cf7d3853b

    • SHA512

      cd7c7837d758ea66abc871503cda6fe99ff45990405e60c1133e7c1f4cb29ee69723c9558bb2d3eccb42948da57351f4f095062616686ab2e255acd3c86236f0

    • SSDEEP

      12288:LMlGLQXTZou76VIx2TERZ3ej5dMNzLY5S9ZSVrBO0Pcx30jH8+F:Lc9XTZsVIxJRZuj5dMNzLY5S9ZSVrBOg

    Score
    3/10
    • Target

      locales/ar.pak

    • Size

      794KB

    • MD5

      3c2ab7363018db1f20b90acbc305cb4c

    • SHA1

      60b9cf453178ad0e60faf20d137a0c7eabde65c9

    • SHA256

      3ca47b9c436723f837a53b2904b51efdf13ab6cad2f3ef4fe48a1115847eccbf

    • SHA512

      589beb3e95e93f30341933c9b9826210e6bf3e9c1ad8f113d9d8a98fa5a526f81e454ee3357fb55d60d67a4890ce33e964ba2fa810e1771a6b7e82746492313a

    • SSDEEP

      12288:EyBYh5/N/RaWH4gzWvwU5Twikcb5uNi3+D2qeTT:E3aR/5D+M

    Score
    3/10
    • Target

      locales/bg.pak

    • Size

      828KB

    • MD5

      a69f6075863d47b564a2feb655a2946f

    • SHA1

      062232499ff73d39724c05c0df121ecd252b8a31

    • SHA256

      a5eb7038ed956bad7704a722f05691474ff709dffbad92b8e31dbb869ad58334

    • SHA512

      930ce3938aa02a8bcc609a64bd86b7e6164d63baad157a980fd079859a6bee5db87bd1f7a74a71108f8368bc9c6154bf14a2dba1abf269f572bc262614bcf1db

    • SSDEEP

      24576:T3ChsqKaElYMdAs1axUjHh373Zj93aAK5kVDgQwRunpKd2ao57JqueRSnQFwN/6B:TChsqKaElYtUjHh373Z53a1kVDgQw1dn

    Score
    3/10
    • Target

      locales/bn.pak

    • Size

      1.0MB

    • MD5

      d43ce80ddca3fab513431fa29be2e60a

    • SHA1

      3e82282e4acfec5f0aca4672161d2f976f284a0c

    • SHA256

      87670ff2ceb1ebc38fce2c3b745ac965f3de5de3133d99ed33933a8f3e99d874

    • SHA512

      1d33ca9bacb91ef328f89a14777a704000bf30fe59aa1cbbbff34d8bad266c98d78c9e411e289e834e76eb721dd98934426a565cd5b3436d5a103abe37f7612a

    • SSDEEP

      3072:PAUxhq6CLf6bXs8iQ2Zc2EadKZ0ZfQ0/QeIyTtPukkBBbpUDDM5JiXldW:4K46CjYYZ82IypPubBbf5IlI

    Score
    3/10
    • Target

      locales/ca.pak

    • Size

      503KB

    • MD5

      2d30c5a004715bc8cd54c2e21c5f7953

    • SHA1

      fed917145a03d037a32abac6edc48c76a4035993

    • SHA256

      d9c45d55a9a5661063b9bbebb0615de8f567f3925d04fd10938da9617c6220e0

    • SHA512

      b3803551f53d290d8839789f829afc9c1e12052c81ba20d5e01fb3d2bacd5d1e97bd4c05074322eed17fdec04c9176c655076faec8a3aef17c39fb999e0c1fcf

    • SSDEEP

      12288:KhBp7kcELygV3z5PAF4N3Mw2juwHzejm0t3lvq8E9oCRaIs3cmlLEY2CJkEydROC:Khh4V8RPS9lMN4MZRg5P56iq

    Score
    3/10
    • Target

      locales/cs.pak

    • Size

      518KB

    • MD5

      06e3fe72fdc73291e8cf6a44eb68b086

    • SHA1

      0bb3b3cf839575b2794d7d781a763751fe70d126

    • SHA256

      397134d1834f395f1c467a75d84ef2e8545cb0f81e94dbe78b841fbbdaad802d

    • SHA512

      211594c30ad4f5ca8813596b59751168c60dfa0d13f24f2aa608fce82d21c2de3de69fe007c4bde1602da8aa7ea81ec0f15e173abc1224362c36b493b425b425

    • SSDEEP

      12288:ljXB+Hdo1ryvJvtQW5EK8VPDNOQ3SCmPs:ljXwHO1uvJ195EK8V5ObCmPs

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
7/10

behavioral4

executionpersistencespywarestealer
Score
7/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
7/10

behavioral10

Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
3/10

behavioral28

Score
3/10

behavioral29

Score
3/10

behavioral30

Score
3/10

behavioral31

Score
3/10

behavioral32

Score
3/10