Behavioral task
behavioral1
Sample
Astral.exe
Resource
win10v2004-20240508-en
General
-
Target
Astral.exe
-
Size
346KB
-
MD5
eade82b2494f8d47a94f181b06476771
-
SHA1
7ffe8d031c745da69bbf935096294a4e6d72f02a
-
SHA256
087ddd27aef668f5ce26030cea6e730cdecdb427a57720445b93e9f60aab4d54
-
SHA512
b3617fba5e4d3f8bbff99ed1aed21b7396571ce63e17f80d2535ba20e459c7252c83220025e72c3d997f2f86893520928ab99c6b155968b7a7809a65d9f7f6af
-
SSDEEP
6144:YFGabOrNm+MFCjfOFzmLRf2jWp41TKDWm+O:YFG7IR4/6EV
Malware Config
Extracted
xworm
record-co.gl.at.ply.gg:46979
-
Install_directory
%AppData%
-
install_file
Astral.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Astral.exe
Files
-
Astral.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ