�X����Ȇ��ұCB�h�#H�E���:|�V������ǻTll��P����9�챀F��x ���r�.=�@�f��4��nC��I�fY�*���>���F�yi��%�t�^�hxұ�W-���^��,[��jB�$����s�oT{�~�~�+�����0b���d�J����9v��b�� �i���ͳ%�v�����*Oc��C���I��ZJ�i~�/�&ҫ�Ez��N����r鴚��%*uʜ���uo�=l�z� �n�aW�΅@���bc����0��p/�n���)p�v��;ڸ�u��k���#�0豥2��� �H�9��V���<=+uX������-"�]Zf���#D$��"?���oj��u�s�&E���$V̚�N4#��aTL���-�.���uJ,�?�5��h��J�0lV�+ӫe�?ر(,w�h'SE�3)��P7`�����.��\3����v�e��rV��U�Ƀ�~f�'/�tլ��2mv�z�_�n�5��4��æ�yzyq��W��=����4�29��Q_�K��o6�~ςh6�P�Yz��@���8�еV��DW9���m�:��wD'J] �I?x�:������>ֹ0�3i � v��D2�w��_�Z�s��� �w�M~�-[�ز����\�~�dK�[ �7�얨j���)j����]f^����亁��/��Q�귝�d����v������5W�o��7$���V�w�#$EM*Q� �S�x�G����o�w�#�Z �T�QN�>��auvX���EC�^����= �� �xD{��n����Ra8����H�b��$7�Z0���k` ��\?�F�X�t3�ܩ��\�/U��NN}��EcZJU�X/�����aR�7�qb��+}��2h��!��R<��^z�v^ �vȴt6��߫��Y1�t�7M4�!ǡ��Q�a!����6�D��Fn�Q�� ������_��*&z�F"<3C�륞���B��I�����ղ��#}�hh��N-xf`^��"�{�W�GZ��t���Z�LJr?��(c��F9Q��7��.��{�u9D(��<Ƈ��0��Nm���O〧�Qg�d��ycc>�?! �W����k�bz����j�]q�Ba�k�Qق ?�U3@Wr��ni�ay>Hl ����'#��p��JR����?��`�L�fzk9�>ɩIJ��Qy?�ȯҰ���������P�����b�+M|a�Xp�ޡ����$y{����вqU%�4̱0�aʤɨ����4��{�s�4;mD��\��.&*s~�5$FaO<:���ϝ�l�]r����@�$�����E�� ��� <��?��\��G{���� hϺkFt�9-�hH��?|snӁy�^9��������`��m�u�.���)��U:�[Pg��꜡�\���Bry�h�4���4���}�W"�!E���ֻ�_�V���|U�z��_��j6GPoG�7�0Vlu�!n��T�E�[�>͞�ɿ܊��5P��v����ɼ�ڡt5I��o�ݲ[�3�ڪgO�:��d�ܵ�-� �X�đ�����|�����Ym�Xg��N}�I�ʟ�.x��]$�4�c�{��瞨�ȠV��ae��� O��������꿿@�����\���0Gq~�W�MA��%���r������84��Q�8��prz�)���^�A���#�]��Kl�(���~��"'?|����Eְق�4YF'�i�865��Ҧ���q��ON���x�=�K���v��ri^�]�4��4�5��*�>!>uC��7Φ��Jn���?+�?�����/��������|���� ���:e�a\�6�M��5��R��jxm�T�=�1���dKa��z/܄B<��mk"q�.�́5�\uU]���䳋N�������� ��-4�CS�� ����֘t��s]-�q�woj�M߂���d�����)8C������A+,6���E��� Ł�BĦ��X2 �[������B5����_�����`~��4������������<t��~�@ᇱ��<�e��I�s8"?��n�d�]{�����L�yW��E�4�A��'yԨ^}�䘛�ǽ�� r��c�)�:"ޒ/?t�}���0�8��"4 �Ǎ� ������5-�䈘]����o͝ 5+F�X3�̧rw�Uȝ�Q�^��e@1/o�6��#e=�9�Vz@0#�-�����X��!��l�c��h�"X'��O�Ү�n�y�߫sNN�h-��rI�:�0a�Xv�|�鼒��{���v�=t��B�qo[��V캄*��ӧgTBqh\�(�~n�vm���frه�)'��$�M.AnV8^}�$4Lz�&*ZdN�3�?���������)_��Ե�>k:�W|�ib���viv�������P.6=s�� ���s�E�����s�m����/�� q~���6àr$���F�߂�4 ��='��#0�%��4`�q~�_�����1YH�@َ�1�ɼ^P\��z��踄K �%���b� K�л�''wvK�UC�:���Q:`5��v-YJ�����aP ��!���M�ׁ(�w ��a)���;i;ӡlA� ��Z�H��{�o��_����gq��7���K����F^p�D07�0�4�c���x��҅�GOHӲ�qF���N�ah��v{[�n�����p�����Nf�.��r�V��i<i��dϱ{y�U�� k�v� �`z�����[*k�ǍQiᦦ�m ��}D#��I{���K�L�S|!eއY����]E�6oՎ|�����5�-�0;�P�2;ec�ҥ�n�O����=�8e�����,�����ں1i�O%�u��G�_\1ktLd�he�0@h7��D�C��'{k�1%-��cUʸ���oX��ʅTN�\�蹱6�w��ޏ4��4���mմ ?�$���P���_xQ�e���b�qq�{ּ4����FaA��fr}>�MOmjfl)'�?�wb�o}`(t
Static task
static1
Behavioral task
behavioral1
Sample
AstraLoader.exe
Resource
win10v2004-20240802-fr
General
-
Target
AstraLoader.exe
-
Size
14.2MB
-
MD5
7102c09fb94e9be07ff9e7cc55f17dbb
-
SHA1
8348c8c9078116dda2712efdd3bb3c7294cfdcb5
-
SHA256
381cc66a36716f893beb96a1c35bbb6b10f81cbbe9add0d92131eda2d8c2381e
-
SHA512
a30d88ce8fcf7b2f366b8dd221ad34fca97e0d4a55dff475596ffbda2da6c46e18be1fd3240d0f766fef2520d4d5b7e7006c3947f4e469dda544c9cd9b0e90fc
-
SSDEEP
393216:alsGGwM3ZMm6Wzod3prdUtSlq8y33BueGa:alsGGwM3ZTEJ7U8m3Buy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AstraLoader.exe
Files
-
AstraLoader.exe.exe windows:6 windows x64 arch:x64
c45619db1c7de6d4bbf55ccdfdb004b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GlobalLock
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
CharUpperBuffW
advapi32
GetLengthSid
shell32
ShellExecuteA
ole32
CoSetProxyBlanket
oleaut32
SysAllocString
msvcp140
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
shlwapi
PathCombineA
winhttp
WinHttpReceiveResponse
iphlpapi
GetAdaptersInfo
mpr
WNetGetProviderNameW
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
userenv
UnloadUserProfile
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertCloseStore
ws2_32
connect
rpcrt4
UuidToStringA
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
fgets
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-math-l1-1-0
cos
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 578KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.o$o Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.T'P Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.\;K Size: 14.1MB - Virtual size: 14.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ