0e173c2a2d3d5e7b98d3e93423e6f3cb906459ff9a61d9e7c451787411995612

General

Target
Astral.rar
Size 15.4MB
Sample260723-mgqbasbg66
SHA256 0e173c2a2d3d5e7b98d3e93423e6f3cb906459ff9a61d9e7c451787411995612
MD5 c8e7dc1384f8ec1fe1d704d0a8cb102c
SHA1 79cbafd1d35586a0ecf8c059e9eb61824c7bc6a9
SHA512 1c02f5311db38d7297c6dfc6c8f9f55ae9d38cd73f3c17a5adadea8003c2a020a13b33f09c79c1749f24c80516349536939404c66891fb0768b934739e64b199
SSDEEP 393216:1BPTaFckvsrgFIuOhXYGU04z9ZGceZen/UxZ+/FzeUww:1tGqkvignOhIGpkrvn/cUNzX
TLSH
T122F633B297319C56864AE23636DDC18438A51313DE3FF7A61474E83F6EB24437E48B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

agilenet

Malware Config

Targets

- Target
  ASTRAL 2.0/Astral.exe
- Size 12.8MB
- SHA256 566fed7c0f5027414066594ef3580224795683be610d005d414ef1bdd6ae455d
- MD5 1ee5f98fbb806a712f1b604fc4c4c28a
- SHA1 cdad412d23992b37dacb37286e9c149cef5fd05f
- SHA512 01e261de6fce9309798d56cfba21dfe535bfee555c47a42fbbd9dce8dcb3c2e6144200a14bf01aa9bcc53a32116fd7b522f120cdcc708b3874e829f7cfd58b0f
- SSDEEP 196608:8R8RPkEivhLzXkZgJPCryHhM1Y2PyIiT8S6RDYv7L1IOUTcEdfL:8R8RPkRvh/JWyHySTKU7L1p2cE
- TLSH
  T1F3D6126358B3AF41F9694C3457635E69021C3C2F0BE90608A59EFF4B34A3D6630AF95E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

agilenet
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  ASTRAL 2.0/DNGRTx64.dll
- Size 5.3MB
- SHA256 ddeb3041ff32da6d6a98e90941ec18f45b7a8afb2b738394de3073d774dfde4a
- MD5 a428c3e775add87c7915381a88061888
- SHA1 aaf1ef5d8924e92961bf81d07c2d6886e1e01585
- SHA512 29f8d8787e41370e0373bd01021783190fb752f6b37881462ebf7edd9bda9f530f59c125c3ca1ba8f88dde1200a3015868eaf718a9ad09ffc2ad6396a0f098d1
- SSDEEP 98304:yTPCS2FAxDgcE2WT6GFmtMImE2g5gKU/eh8ZnPbLMvlllmUjTF3WlN/vd:hcD7mCtXmpd/egPbLMvXQ+GlBd
- TLSH
  T1C94622ED6144334CD41EC5349933FD09B2BA542E0BD6A9FEB2DB6BD0B79E014DA42B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Contacts third-party web service commonly abused for C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4