Overview

overview

10

Static

static

10

astral.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    astral.exe

  • Size

    6.0MB

  • Sample

    241017-xll5jstbqj

  • MD5

    035bd405067e27e1740978474aa6ad3c

  • SHA1

    a2837cd147b132cf7b69eb5f0b4e7e2991fe9fca

  • SHA256

    b6b3809e3edea2c16305dda26edc8c9a9e1ebc5ab80c2eb8403596c5be0d7d0b

  • SHA512

    4add47d305fe070037a4eca9bedac444efe324c6cfb9d973f53553fb2482a8fe7eda28fb802e1b1f373044d479b653f743f735a129e3019bdd282b7d4097eb93

  • SSDEEP

    98304:XCEtdFBy3P41amaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RkBMI73h70:XJFMReN/FJMIDJf0gsAGK4RkuI10

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      astral.exe

    • Size

      6.0MB

    • MD5

      035bd405067e27e1740978474aa6ad3c

    • SHA1

      a2837cd147b132cf7b69eb5f0b4e7e2991fe9fca

    • SHA256

      b6b3809e3edea2c16305dda26edc8c9a9e1ebc5ab80c2eb8403596c5be0d7d0b

    • SHA512

      4add47d305fe070037a4eca9bedac444efe324c6cfb9d973f53553fb2482a8fe7eda28fb802e1b1f373044d479b653f743f735a129e3019bdd282b7d4097eb93

    • SSDEEP

      98304:XCEtdFBy3P41amaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RkBMI73h70:XJFMReN/FJMIDJf0gsAGK4RkuI10

    Score
    8/10
    discoveryexecutionupx

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks