Overview

overview

10

Static

static

3

SecuriteIn...51.exe

windows10-2004-x64

10

SecuriteIn...51.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Variant.Zusy.548548.28004.751.exe
  • Size 1.2MB
  • Sample250526-a225datvh1
  • SHA256 4d3c3ffd581a9f1e9e6e7b67e18da73ea2c042455466a7e80e9457a431ec25ac
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
celestialratleb1.8trojan

Malware Config

Extracted

Family

  • celestialrat

Version

  • 0.0.1

Campaign

  • Leb1.8

C2

  • 193.233.113.61:3333

Mutex

  • Celestial_4381621064065942400788

Attributes
  • auto_start_type

    TaskScheduler

  • blacklisted_countries

    RU;US;BY

  • bootkit

    True

  • botkiller

    True

  • client_filename

    NVDisplay.Container.exe

  • client_subfolder

    NVIDIA\NvidiaLibs

  • command_line

    %CommandLine%

  • connection_type

    Dynamic

  • country_blacklist

    False

  • detectdebugger

    True

  • detectsandboxie

    True

  • detectsmalldisk

    True

  • detectvm

    True

  • detectwindowsxp

    True

  • disable_install_prompt

    True

  • disablecmd

    False

  • disabledefender

    False

  • disablefirewall

    True

  • disableregistry

    False

  • disablerun

    False

  • disabletaskmanager

    False

  • disableuac

    True

  • disablewinkeys

    False

  • hidden_attributes

    True

  • hidden_key

    False

  • highest_priority

    True

  • hollowed_process

    %HollowedProcess%

  • hosts_blacklist

    False

  • install_client

    True

  • libraries_subfolder

    NVIDIA\ComputeCache\Libs

  • lotl_application

    %LOTLApplication%

  • melt_file

    True

  • pastebin

    https://pastebin.com/raw/8QkMdDVk

  • registry_key

    Celestial

  • root_client_folder

    %localappdata%

  • root_libraries_folder

    %appdata%

  • root_watchdog_folder

    %temp%

  • rootkit

    False

  • rtlsetprocesscritical

    True

  • system_attributes

    True

  • task_name

    NVIDIA App SelfUpdate_{VBUH8FGTH4H4GH4-4WDFH-2D98JG9RJ9}

  • try_other_method

    True

  • usb_spread

    False

  • usb_spread_filename

    SteamLoader.exe

  • watchdog

    %temp%

  • watchdog_filename

    watchdog

Targets

    • Target
      SecuriteInfo.com.Variant.Zusy.548548.28004.751.exe
    • Size 1.2MB
    • SHA256 4d3c3ffd581a9f1e9e6e7b67e18da73ea2c042455466a7e80e9457a431ec25ac
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    celestialratleb1.8trojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks