Overview

overview

10

Static

static

10

FinalMom.exe

windows10-ltsc_2021-x64

10

FinalMom.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    FinalMom.exe
  • Size 936KB
  • Sample250618-rl356sen4x
  • SHA256 0a7398292f37cf93e9bff0314cf0c4ffa8253071fbbe525d4268e2d171be80da
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
celestialratguestu�mg�defense_evasiontrojan

Malware Config

Extracted

Family

  • celestialrat

Version

  • 1.0.2

Campaign

  • U�mg�

Mutex

  • Q�dq���.��kE��pM1�8҉0���a��

Attributes
  • auto_start_type

    V�{u���+

  • blacklisted_countries

    @�3A���

  • bootkit

    T�dg�

  • botkiller

    T�dg�

  • client_filename

    Q�dq���.��7 �

  • client_subfolder

    Q�dq���.�

  • command_line

    %CommandLine%

  • connection_type

    A�i`��

  • country_blacklist

    T�dg�

  • detectdebugger

    T�dg�

  • detectsandboxie

    T�dg�

  • detectsmalldisk

    T�dg�

  • detectvm

    T�dg�

  • detectwindowsxp

    T�dg�

  • disable_install_prompt

    T�dg�

  • disablecmd

    T�dg�

  • disablefirewall

    T�dg�

  • disableregistry

    T�dg�

  • disablerun

    T�dg�

  • disabletaskmanager

    T�dg�

  • disableuac

    T�dg�

  • disablewinkeys

    T�dg�

  • hidden_attributes

    T�dg�

  • hidden_key

    T�dg�

  • highest_priority

    T�dg�

  • hollowed_process

    %HollowedProcess%

  • hosts_blacklist

    T�dg�

  • install_client

    F�}q

  • libraries_subfolder

    Q�dq���.��;�

  • lotl_application

    %LOTLApplication%

  • melt_file

    T�dg�

  • pastebin

    z�|d�ٓ`��!���+WP`�a��Z,�k���

  • registry_key

    Q�dq���.�

  • root_client_folder

    7�xd���.�

  • root_libraries_folder

    B�gs���oف>��

  • root_watchdog_folder

    7�my��

  • rootkit

    T�dg�

  • rtlsetprocesscritical

    T�dg�

  • system_attributes

    T�dg�

  • task_name

    Q�dq���.�

  • try_other_method

    T�dg�

  • usb_spread

    T�dg�

  • usb_spread_filename

    Q�dq���.��7 �

Extracted

Family

  • celestialrat

Version

  • 1.0.2

Campaign

  • Guest

C2

  • 127.0.0.1:3333

Mutex

  • Celestial_9112213264593432444112

Attributes
  • auto_start_type

    Disabled

  • blacklisted_countries

    RU;US;BY

  • bootkit

    False

  • botkiller

    False

  • client_filename

    Celestial.exe

  • client_subfolder

    Celestial

  • command_line

    %CommandLine%

  • connection_type

    Static

  • country_blacklist

    False

  • detectdebugger

    False

  • detectsandboxie

    False

  • detectsmalldisk

    False

  • detectvm

    False

  • detectwindowsxp

    False

  • disable_install_prompt

    False

  • disablecmd

    False

  • disablefirewall

    False

  • disableregistry

    False

  • disablerun

    False

  • disabletaskmanager

    False

  • disableuac

    False

  • disablewinkeys

    False

  • hidden_attributes

    False

  • hidden_key

    False

  • highest_priority

    False

  • hollowed_process

    %HollowedProcess%

  • hosts_blacklist

    False

  • install_client

    True

  • libraries_subfolder

    CelestialLibs

  • lotl_application

    %LOTLApplication%

  • melt_file

    False

  • pastebin

    https://pastebin.com/raw/XXXXXX

  • registry_key

    Celestial

  • root_client_folder

    %appdata%

  • root_libraries_folder

    Program Folder

  • root_watchdog_folder

    %temp%

  • rootkit

    False

  • rtlsetprocesscritical

    False

  • system_attributes

    False

  • task_name

    Celestial

  • try_other_method

    False

  • usb_spread

    False

  • usb_spread_filename

    Celestial.exe

xor.hex

Targets

    • Target
      FinalMom.exe
    • Size 936KB
    • SHA256 0a7398292f37cf93e9bff0314cf0c4ffa8253071fbbe525d4268e2d171be80da
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    celestialratguestdefense_evasiontrojan

    • CelestialRAT

      CelestialRAT is a trojan written in C#.

      trojancelestialrat

    • Celestialrat family

      celestialrat

    • Detects CelestialRAT.

    • Executes dropped EXE

    • ConfuserEx .NET packer

      Detects ConfuserEx .NET packer.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks