Overview

overview

10

Static

static

10

FinalMom.exe

windows10-ltsc_2021-x64

10

FinalMom.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    FinalMom.exe
  • Size 936KB
  • Sample250618-rl356sen4x
  • SHA256 0a7398292f37cf93e9bff0314cf0c4ffa8253071fbbe525d4268e2d171be80da
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
u�mg�celestialrat

Malware Config

Extracted

Family

  • celestialrat

Version

  • 1.0.2

Campaign

  • U�mg�

Mutex

  • Q�dq���.��kE��pM1�8҉0���a��

Attributes
  • auto_start_type

    V�{u���+

  • blacklisted_countries

    @�3A���

  • bootkit

    T�dg�

  • botkiller

    T�dg�

  • client_filename

    Q�dq���.��7 �

  • client_subfolder

    Q�dq���.�

  • command_line

    %CommandLine%

  • connection_type

    A�i`��

  • country_blacklist

    T�dg�

  • detectdebugger

    T�dg�

  • detectsandboxie

    T�dg�

  • detectsmalldisk

    T�dg�

  • detectvm

    T�dg�

  • detectwindowsxp

    T�dg�

  • disable_install_prompt

    T�dg�

  • disablecmd

    T�dg�

  • disablefirewall

    T�dg�

  • disableregistry

    T�dg�

  • disablerun

    T�dg�

  • disabletaskmanager

    T�dg�

  • disableuac

    T�dg�

  • disablewinkeys

    T�dg�

  • hidden_attributes

    T�dg�

  • hidden_key

    T�dg�

  • highest_priority

    T�dg�

  • hollowed_process

    %HollowedProcess%

  • hosts_blacklist

    T�dg�

  • install_client

    F�}q

  • libraries_subfolder

    Q�dq���.��;�

  • lotl_application

    %LOTLApplication%

  • melt_file

    T�dg�

  • pastebin

    z�|d�ٓ`��!���+WP`�a��Z,�k���

  • registry_key

    Q�dq���.�

  • root_client_folder

    7�xd���.�

  • root_libraries_folder

    B�gs���oف>��

  • root_watchdog_folder

    7�my��

  • rootkit

    T�dg�

  • rtlsetprocesscritical

    T�dg�

  • system_attributes

    T�dg�

  • task_name

    Q�dq���.�

  • try_other_method

    T�dg�

  • usb_spread

    T�dg�

  • usb_spread_filename

    Q�dq���.��7 �

Signatures

  • Celestialrat family
    celestialrat
  • Detects CelestialRAT. 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • FinalMom.exe
    .exe 936KB

FinalMom.exe

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 0a7398292f37cf93e9bff0314cf0c4ffa8253071fbbe525d4268e2d171be80da
  • MD5 SHA1 SHA512 SSDEEP
windows:4windowsx86arch:x86

  • Detects CelestialRAT.

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
963998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths