celestialrat

General

Target
a79dd8a9305570a1032c7d16ff2f1b2b0c6a44a857f977676181e5c9dc7f148d.exe
Size 1.2MB
Sample250709-gqrmtswmt7
SHA256 a79dd8a9305570a1032c7d16ff2f1b2b0c6a44a857f977676181e5c9dc7f148d
MD5 9f944b82db8d9d1cd5dd0eb862d404d3
SHA1 f34bd68d2e8e9b87be1444aefae967d2b895ba77
SHA512 867c47fa757be6cca661e71d351c4f4b1609bc24b2626e47a982bc6f62abc258cfb7e6b8fec2f6d7a5bc56aa30c2f045cd700e99c345719e085bd3c55836eda3
SSDEEP 12288:iuBSC8zeEzKlsos1N0jVOYdgKgjqM4VDje1jHC+zrf29PNI9thvKSxPy9F3RMKGl:aFeEzKlsopjVVdgFMg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

celestialrat [traffic]defense_evasion evasion execution persistence trojan

Malware Config

Extracted

Family

celestialrat

Version

0.0.1

Campaign

[Traffic]

C2

94.156.115.95:1337

Mutex

Celestial_8029996027823020235443

Attributes

auto_start_type
TaskScheduler
blacklisted_countries
RU;US;BY
blacklisted_hosts
www.arcabit.pl;www.avast.com;www.avast.ru;www.avg.com;www.avira.com;www.bitdefender.com;www.bullguard.com;www.clamav.net;www.comodo.com;www.drweb.ru;www.emsisoft.com;www.escanav.com;www.eset.com;www.esetnod32.ru;www.f-prot-antivirus-for-windows.en.softonic.com;www.f-secure.com;www.gdatasoftware.com;www.ikarussecurity.com;www.immunet.com;www.kaspersky.ru;www.maxpcsecure.com;www.mcafee.com;www.nanoav.ru;www.norman.com;www.quickheal.com;www.seqrite.com;www.sophos.com;www.spamfighter.com;www.tgsoft.it;www.trendmicro.com;www.virustotal.com;www.vba32-antivirus.en.softonic.com;www.xvirus.net;www.zillya.ua;www.zonealarm.com;www.zonerantivirus.com
bootkit
True
botkiller
True
client_filename
RunShell.exe
client_subfolder
Libs
command_line
%CommandLine%
connection_type
Static
country_blacklist
False
detectdebugger
False
detectsandboxie
False
detectsmalldisk
False
detectvm
False
detectwindowsxp
False
disable_install_prompt
True
disablecmd
False
disabledefender
True
disablefirewall
True
disableregistry
False
disablerun
False
disabletaskmanager
False
disableuac
True
disablewinkeys
False
hidden_attributes
True
hidden_key
False
highest_priority
True
hollowed_process
%HollowedProcess%
hosts_blacklist
False
install_client
True
libraries_subfolder
Libs
lotl_application
%LOTLApplication%
melt_file
True
pastebin
https://pastebin.com/raw/XXXXXX
registry_key
RunShell
root_client_folder
%UserProfile%
root_libraries_folder
%UserProfile%
root_watchdog_folder
%temp%
rootkit
False
rtlsetprocesscritical
True
system_attributes
True
task_name
RunShell
try_other_method
True
usb_spread
True
usb_spread_filename
usb.exe
watchdog
%temp%
watchdog_filename
watchdog

Targets

- Target
  a79dd8a9305570a1032c7d16ff2f1b2b0c6a44a857f977676181e5c9dc7f148d.exe
- Size 1.2MB
- SHA256 a79dd8a9305570a1032c7d16ff2f1b2b0c6a44a857f977676181e5c9dc7f148d
- MD5 9f944b82db8d9d1cd5dd0eb862d404d3
- SHA1 f34bd68d2e8e9b87be1444aefae967d2b895ba77
- SHA512 867c47fa757be6cca661e71d351c4f4b1609bc24b2626e47a982bc6f62abc258cfb7e6b8fec2f6d7a5bc56aa30c2f045cd700e99c345719e085bd3c55836eda3
- SSDEEP 12288:iuBSC8zeEzKlsos1N0jVOYdgKgjqM4VDje1jHC+zrf29PNI9thvKSxPy9F3RMKGl:aFeEzKlsopjVVdgFMg
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

celestialrat [traffic]defense_evasion evasion execution persistence trojan
- CelestialRAT
  CelestialRAT is a trojan written in C#.
  trojan celestialrat
- Celestialrat family
  celestialrat
- Detects CelestialRAT.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies firewall policy service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1 behavioral2