Overview
overview
7Static
static
3Celestial.zip
windows7-x64
1Celestial.zip
windows10-2004-x64
1Celestial.exe
windows7-x64
7Celestial.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
7$PLUGINSDIR/app-64.7z
windows10-2004-x64
3LICENSE.electron.txt
windows7-x64
1LICENSE.electron.txt
windows10-2004-x64
1chrome_100...nt.pak
windows7-x64
3chrome_100...nt.pak
windows10-2004-x64
3chrome_200...nt.pak
windows7-x64
3chrome_200...nt.pak
windows10-2004-x64
3icudtl.dat
windows7-x64
3icudtl.dat
windows10-2004-x64
3locales/af.pak
windows7-x64
3locales/af.pak
windows10-2004-x64
3locales/am.pak
windows7-x64
3locales/am.pak
windows10-2004-x64
3locales/ar.pak
windows7-x64
3locales/ar.pak
windows10-2004-x64
3locales/bg.pak
windows7-x64
3locales/bg.pak
windows10-2004-x64
3locales/bn.pak
windows7-x64
3locales/bn.pak
windows10-2004-x64
3locales/ca.pak
windows7-x64
3locales/ca.pak
windows10-2004-x64
3locales/cs.pak
windows7-x64
3locales/cs.pak
windows10-2004-x64
3General
-
Target
Celestial.zip
-
Size
84.0MB
-
Sample
240612-3adlxsvcmg
-
MD5
3d97d5efb67de7470ce3607c26b292e4
-
SHA1
4b14f103c0b9c5ad2e4dd4c13c58ed8483fefed1
-
SHA256
e77f9b875a25dcbfbb45c2f2eaf3d1b488fdb2f5cba434f8d5ce7737b3579435
-
SHA512
1546c56ab87d9086dc5849ebe4954cf798ffca1ed79c17c733b4f688611f412d1c40e15bbd159b243c320c28a2fc3ccecfba20c85d1a84c86929605985e62eb5
-
SSDEEP
1572864:ac237cKVO98odr456yGbuxapkkC1DszA8dkBUISvNC1qDhkBuKQO1VwBZtOBI:ac8ISw456yQuYpkqN+BkBZtOBI
Static task
static1
Behavioral task
behavioral1
Sample
Celestial.zip
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Celestial.zip
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Celestial.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
Celestial.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
LICENSE.electron.txt
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
LICENSE.electron.txt
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
chrome_100_percent.pak
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
chrome_100_percent.pak
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
chrome_200_percent.pak
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
chrome_200_percent.pak
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
icudtl.dat
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
icudtl.dat
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
locales/af.pak
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
locales/af.pak
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
locales/am.pak
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
locales/am.pak
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
locales/ar.pak
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
locales/ar.pak
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
locales/bg.pak
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
locales/bg.pak
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
locales/bn.pak
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
locales/bn.pak
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
locales/ca.pak
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
locales/ca.pak
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
locales/cs.pak
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
locales/cs.pak
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
Celestial.zip
-
Size
84.0MB
-
MD5
3d97d5efb67de7470ce3607c26b292e4
-
SHA1
4b14f103c0b9c5ad2e4dd4c13c58ed8483fefed1
-
SHA256
e77f9b875a25dcbfbb45c2f2eaf3d1b488fdb2f5cba434f8d5ce7737b3579435
-
SHA512
1546c56ab87d9086dc5849ebe4954cf798ffca1ed79c17c733b4f688611f412d1c40e15bbd159b243c320c28a2fc3ccecfba20c85d1a84c86929605985e62eb5
-
SSDEEP
1572864:ac237cKVO98odr456yGbuxapkkC1DszA8dkBUISvNC1qDhkBuKQO1VwBZtOBI:ac8ISw456yQuYpkqN+BkBZtOBI
Score1/10 -
-
-
Target
Celestial.exe
-
Size
84.0MB
-
MD5
0e98e512ac1515784a6269c7d937969c
-
SHA1
1acee28be7e518186e132d51d2e6f9af5de40127
-
SHA256
8d9235f95e2e8cbeb94aab443a4a377488c48d5d08f432e8f6298886e72a7e93
-
SHA512
e39c95aa2dc2d0e7eaf7832737fd04eabcf45390f7725f542ef74462a4b186856c3b6548d31aec53a16fc7a43dc81c8338615a2f4ec561476a0c7b7f2d6bd0e2
-
SSDEEP
1572864:t4gPXMoB23K8/dGjCHtc8ZMRAKSl9S9I698t6EmBp692FVSh6gCIP1G9vVKG7:t4AcWmGjCHtc82RAgDkhQ9vVKG7
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
-
-
Target
$PLUGINSDIR/StdUtils.dll
-
Size
100KB
-
MD5
c6a6e03f77c313b267498515488c5740
-
SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15
-
SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
-
SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
SSDEEP
3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
0d7ad4f45dc6f5aa87f606d0331c6901
-
SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457
-
SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
-
SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
SSDEEP
192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score3/10 -
-
-
Target
$PLUGINSDIR/app-64.7z
-
Size
83.7MB
-
MD5
3ea87576bf5faace7ddb9d21d14994af
-
SHA1
42ec62b1bf2f7489630d2e4111af8cc35d120d35
-
SHA256
cd50b7802e58b465d97dd28073465de1b435140f59641cad05c437eaf75faaea
-
SHA512
3440f1a59df6b0d56da75b1929e0836556b25ae3dcc26fba7d35dc49b9ca0e385f923f0d7f2d10c12568b292cb04faba0a90928b6f7a1e712b9c953f0c582295
-
SSDEEP
1572864:94gPXMoB23K8/dGjCHtc8ZMRAKSl9S9I698t6EmBp692FVSh6gCIP1G9vVKo:94AcWmGjCHtc82RAgDkhQ9vVKo
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
-
-
Target
LICENSE.electron.txt
-
Size
1KB
-
MD5
4d42118d35941e0f664dddbd83f633c5
-
SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c
-
SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
-
SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
Score1/10 -
-
-
Target
chrome_100_percent.pak
-
Size
132KB
-
MD5
a0e681fdd4613e0fff6fb8bf33a00ef1
-
SHA1
6789bacfe0b244ab6872bd3acc1e92030276011e
-
SHA256
86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
-
SHA512
6f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196
-
SSDEEP
3072:tezwJCGIekwf9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:tezw1Iek+42k3yMK18Gb0OV8ld0GecQJ
Score3/10 -
-
-
Target
chrome_200_percent.pak
-
Size
190KB
-
MD5
c37bd7a6b677a37313b7ecc4ff01b6f5
-
SHA1
79db970c44347bd3566cefb6cabd1995e8e173df
-
SHA256
8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
-
SHA512
a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb
-
SSDEEP
3072:ADQYaE/N6Mrvy/3JP29W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ADQYaSN6svyd242k3yxgx5GMRejnbdZR
Score3/10 -
-
-
Target
icudtl.dat
-
Size
10.2MB
-
MD5
e0f1ad85c0933ecce2e003a2c59ae726
-
SHA1
a8539fc5a233558edfa264a34f7af6187c3f0d4f
-
SHA256
f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
-
SHA512
714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
-
SSDEEP
196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
Score3/10 -
-
-
Target
locales/af.pak
-
Size
447KB
-
MD5
917a688d64eccf67fef5a5eb0908b6d4
-
SHA1
7206b01bbc3fd8cc937db9050dd8ac86cf44d8cc
-
SHA256
6981249837ad767fc030edc8838878a5e493fb08cc49982cffaed16cfbeb564d
-
SHA512
195dbec8463cf89990232296c5c927e1501f0c2e01a7be7c6a6acae651853ce1edb23d639af65979b39a3c61979119c3a305acfa3aadf0cb93e241c5e57f4534
-
SSDEEP
12288:/cqYYWk0o+wZiSMKVQ2uM2Z12JynA7PIrfsdgSTCSQ2fs37KQOb5t/tn6A/HiaHU:ynk0ofMSMaTuM2Z12JynA7PIrfsdgST4
Score3/10 -
-
-
Target
locales/am.pak
-
Size
727KB
-
MD5
3cfd7c5bb92ab72c63e003208a9e4529
-
SHA1
165d2f69ab6a6e237f0fec943b5577123cefea87
-
SHA256
12e9e1bec1c46e5ea706157726e17a4429acf288a5754fa183bd9b4cf7d3853b
-
SHA512
cd7c7837d758ea66abc871503cda6fe99ff45990405e60c1133e7c1f4cb29ee69723c9558bb2d3eccb42948da57351f4f095062616686ab2e255acd3c86236f0
-
SSDEEP
12288:LMlGLQXTZou76VIx2TERZ3ej5dMNzLY5S9ZSVrBO0Pcx30jH8+F:Lc9XTZsVIxJRZuj5dMNzLY5S9ZSVrBOg
Score3/10 -
-
-
Target
locales/ar.pak
-
Size
794KB
-
MD5
3c2ab7363018db1f20b90acbc305cb4c
-
SHA1
60b9cf453178ad0e60faf20d137a0c7eabde65c9
-
SHA256
3ca47b9c436723f837a53b2904b51efdf13ab6cad2f3ef4fe48a1115847eccbf
-
SHA512
589beb3e95e93f30341933c9b9826210e6bf3e9c1ad8f113d9d8a98fa5a526f81e454ee3357fb55d60d67a4890ce33e964ba2fa810e1771a6b7e82746492313a
-
SSDEEP
12288:EyBYh5/N/RaWH4gzWvwU5Twikcb5uNi3+D2qeTT:E3aR/5D+M
Score3/10 -
-
-
Target
locales/bg.pak
-
Size
828KB
-
MD5
a69f6075863d47b564a2feb655a2946f
-
SHA1
062232499ff73d39724c05c0df121ecd252b8a31
-
SHA256
a5eb7038ed956bad7704a722f05691474ff709dffbad92b8e31dbb869ad58334
-
SHA512
930ce3938aa02a8bcc609a64bd86b7e6164d63baad157a980fd079859a6bee5db87bd1f7a74a71108f8368bc9c6154bf14a2dba1abf269f572bc262614bcf1db
-
SSDEEP
24576:T3ChsqKaElYMdAs1axUjHh373Zj93aAK5kVDgQwRunpKd2ao57JqueRSnQFwN/6B:TChsqKaElYtUjHh373Z53a1kVDgQw1dn
Score3/10 -
-
-
Target
locales/bn.pak
-
Size
1.0MB
-
MD5
d43ce80ddca3fab513431fa29be2e60a
-
SHA1
3e82282e4acfec5f0aca4672161d2f976f284a0c
-
SHA256
87670ff2ceb1ebc38fce2c3b745ac965f3de5de3133d99ed33933a8f3e99d874
-
SHA512
1d33ca9bacb91ef328f89a14777a704000bf30fe59aa1cbbbff34d8bad266c98d78c9e411e289e834e76eb721dd98934426a565cd5b3436d5a103abe37f7612a
-
SSDEEP
3072:PAUxhq6CLf6bXs8iQ2Zc2EadKZ0ZfQ0/QeIyTtPukkBBbpUDDM5JiXldW:4K46CjYYZ82IypPubBbf5IlI
Score3/10 -
-
-
Target
locales/ca.pak
-
Size
503KB
-
MD5
2d30c5a004715bc8cd54c2e21c5f7953
-
SHA1
fed917145a03d037a32abac6edc48c76a4035993
-
SHA256
d9c45d55a9a5661063b9bbebb0615de8f567f3925d04fd10938da9617c6220e0
-
SHA512
b3803551f53d290d8839789f829afc9c1e12052c81ba20d5e01fb3d2bacd5d1e97bd4c05074322eed17fdec04c9176c655076faec8a3aef17c39fb999e0c1fcf
-
SSDEEP
12288:KhBp7kcELygV3z5PAF4N3Mw2juwHzejm0t3lvq8E9oCRaIs3cmlLEY2CJkEydROC:Khh4V8RPS9lMN4MZRg5P56iq
Score3/10 -
-
-
Target
locales/cs.pak
-
Size
518KB
-
MD5
06e3fe72fdc73291e8cf6a44eb68b086
-
SHA1
0bb3b3cf839575b2794d7d781a763751fe70d126
-
SHA256
397134d1834f395f1c467a75d84ef2e8545cb0f81e94dbe78b841fbbdaad802d
-
SHA512
211594c30ad4f5ca8813596b59751168c60dfa0d13f24f2aa608fce82d21c2de3de69fe007c4bde1602da8aa7ea81ec0f15e173abc1224362c36b493b425b425
-
SSDEEP
12288:ljXB+Hdo1ryvJvtQW5EK8VPDNOQ3SCmPs:ljXwHO1uvJ195EK8V5ObCmPs
Score3/10 -
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1