Analysis

  • max time kernel
    32s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2025, 13:52 UTC

General

  • Target

    net8.0-windows/Astral Stealer.exe

  • Size

    139KB

  • MD5

    726c717d3e26f216b316f169ae4befd2

  • SHA1

    673efa718917cfd5685a3fa91f8ca0607ee59bda

  • SHA256

    1e7a930303762a3a1f8678da099225d9276d1a9fa16ced07a9fb4f14e0201bd9

  • SHA512

    2438ec07d41d19f7c4aa1885408784f5d68bcf979b5481cf0de14bfdb5d91d9b96ef6d651291733e4141e4b8f23bbb139baa04ebb92033ca9c4b9797519adb52

  • SSDEEP

    3072:PiS4omp03WQthI/9S3BZi08iRQ1G78IVn2sbS7cJp8lt2:PiS4ompB9S3BZi0a1G78IVAcLct

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\net8.0-windows\Astral Stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\net8.0-windows\Astral Stealer.exe"
    1⤵
    • Checks computer location settings
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    PID:3208

Network

  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    188.77.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    188.77.23.2.in-addr.arpa
    IN PTR
    Response
    188.77.23.2.in-addr.arpa
    IN PTR
    a2-23-77-188deploystaticakamaitechnologiescom
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    203.109.54.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    203.109.54.23.in-addr.arpa
    IN PTR
    Response
    203.109.54.23.in-addr.arpa
    IN PTR
    a23-54-109-203deploystaticakamaitechnologiescom
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
No results found
  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    188.77.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    188.77.23.2.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    203.109.54.23.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    203.109.54.23.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
    1

    DNS Request

    18.31.95.13.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.