General
- Target FinalMomj.exe
- Size 1.2MB
- Sample260601-x661fsd12t
- SHA256 7ca8a4f6296d7cd8d95045f4a4049417de436f83d13c461acc9c18ba4d6405c9
Score
10/10
Malware Config
Extracted
Family
-
celestialrat
Campaign
-
88888
C2
-
185.172.65.9:6767
Mutex
-
Quantum_4015792844252265846021
Attributes
-
a_recovery
true
-
ask_install
false
-
autorun_hidden
false
-
autorun_highest
false
-
autorun_method
none
-
cblack
false
-
cblack_list
RU;US;BY
-
chrome_kill
false
-
crit_process
false
-
default_webhook
https://discord.com/api/webhooks/1509579449035788379/Rcz2y0IiwqsCj2fZBpA9hnpXiD5_Xb66ggTSvq_1iDG-8FRChumCHbcGBLzxWZ9Dcyxg
-
detect_debugger
true
-
detect_sandboxie
true
-
detect_xp
true
-
detects_malldisk
true
-
disable_cmd
false
-
disable_firewall
false
-
disable_registry
false
-
disable_run
false
-
disable_taskmgr
false
-
disable_uac
false
-
disable_win_keys
false
-
disable_windef
false
-
hide_everything
false
-
hide_everything_sys
false
-
hosts_edit
false
-
install_folder
%appdata%
-
install_melt
false
-
install_name
Celestial.exe
-
install_subfolder
Celestial
-
is_lotl
false
-
is_server_var
false
-
lib_folder
Same
-
lib_subfolder
CelestialLibs
-
name_in_tasks
Celestial
-
need_install
false
-
needadm
False
-
password_var
P@SSw0rd
-
pastebin_link
https://pastebin.com/raw/XXXXX
-
registry_keyname
Celestial
-
try_another_if_fails
false
-
usbspr
false
-
usbspr_name
Celestial.exe
-
use_pastebin
false
-
watchdog
false
-
watchdog_loc
%temp%
-
watchdog_name
watchdog.vbs
Targets
-
- Target FinalMomj.exe
- Size 1.2MB
- SHA256 7ca8a4f6296d7cd8d95045f4a4049417de436f83d13c461acc9c18ba4d6405c9
Score10/10-
Family: CelestialRAT
CelestialRAT is a trojan written in C#.