Astraeus[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Astraeus.exe
Size 1.2MB
Sample260908-pmlleabl7x
SHA256 b10f6b41249cc5a03a2a852c101eb574454ff5312e9820d32dea9b155d44b729
MD5 3f5e167ebdd9b0815bceea8b65a28b07
SHA1 3120d6bf3578740460c0d686c50dc88aa0036070
SHA512 7a1e490a01778c56e6d49a93e51dcd043b2936b465c5b8c3df8bcf5afec2e14d03f41461aa7f72263ea0b08ddb0c98ba2d45f9a144287d8f024119e22d9b289b
SSDEEP 24576:7f4h1kFIUwDJzCBshKdLaRotkjSAPM06bm0biUnwru0GfFo:7f4hCCGB2rGESAUPoUn4uPfFo
TLSH
T165458D1EA2A441FBD07A9178FAC5990BE6723C0907709AFF17D00A951F77EE05B7A702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Astraeus.exe

File Explorer

Astraeus.exe

.exe 1.2MB

Astraeus.exe

IMPHASH 8354be48af9d904e0b979dc797bc8e53
SHA256 b10f6b41249cc5a03a2a852c101eb574454ff5312e9820d32dea9b155d44b729
MD5 3f5e167ebdd9b0815bceea8b65a28b07
SHA1 3120d6bf3578740460c0d686c50dc88aa0036070
SHA512 7a1e490a01778c56e6d49a93e51dcd043b2936b465c5b8c3df8bcf5afec2e14d03f41461aa7f72263ea0b08ddb0c98ba2d45f9a144287d8f024119e22d9b289b
SSDEEP 24576:7f4h1kFIUwDJzCBshKdLaRotkjSAPM06bm0biUnwru0GfFo:7f4hCCGB2rGESAUPoUn4uPfFo
TLSH
T165458D1EA2A441FBD07A9178FAC5990BE6723C0907709AFF17D00A951F77EE05B7A702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

680332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

d3dcompiler_47

D3DCompile

winhttp

WinHttpOpen WinHttpSetOption WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpCloseHandle WinHttpCrackUrl WinHttpSendRequest WinHttpSetTimeouts WinHttpReceiveResponse WinHttpReadData WinHttpConnect WinHttpOpenRequest

bcrypt

BCryptCreateHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptFinishHash

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize

shell32

ShellExecuteW SHFileOperationW ShellExecuteExW SHCreateItemFromParsingName SHGetPathFromIDListW SHCreateDirectoryExW SHGetFolderPathW SHBrowseForFolderW CommandLineToArgvW ShellExecuteA

advapi32

RegCreateKeyExW RegDeleteValueW RegGetValueA RegCloseKey RegSetValueExW RegQueryValueExW RegOpenKeyExW

kernel32

LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx RaiseException RtlPcToFileHeader FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetConsoleMode GetFileSizeEx SetStdHandle HeapSize WriteConsoleW GetCommandLineW CreateFileA CreateFileW DeleteFileA DeleteFileW FindClose FindFirstFileA GetFileAttributesA GetFileAttributesW ReadFile SetFileAttributesW WriteFile CloseHandle GetLastError PeekNamedPipe WaitForSingleObject CreateMutexW Sleep GetCurrentProcessId ExitProcess TerminateProcess ResumeThread CreateProcessW OpenProcess GetLogicalProcessorInformationEx VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetModuleFileNameA GetModuleFileNameW LocalFree GetProcessAffinityMask SetProcessAffinityMask CopyFileW MoveFileExW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModulesEx K32GetModuleBaseNameW K32GetModuleInformation OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress GetUserDefaultLCID GetLocaleInfoA IsDBCSLeadByte SetFilePointerEx GetModuleHandleW QueryFullProcessImageNameA ReleaseSemaphore ReleaseMutex CreateMutexA CreateSemaphoreA GetStdHandle GetModuleHandleExA SetConsoleTextAttribute SetLastError MapViewOfFile UnmapViewOfFile CreateFileMappingA OpenFileMappingA InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx ExitThread DecodePointer EncodePointer WakeAllConditionVariable GetSystemTimeAsFileTime DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx CreateThread EnumSystemLocalesW FlushFileBuffers SetEndOfFile GetConsoleOutputCP FreeLibraryAndExitThread GetModuleHandleExW HeapFree HeapAlloc IsValidLocale ReadConsoleW GetTimeZoneInformation HeapReAlloc FindFirstFileExW GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue LoadLibraryA RtlUnwind FlsAlloc GetFileType

user32

SetProcessDPIAware LoadCursorW ScreenToClient SetCursor SetCursorPos IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW GetWindow GetWindowThreadProcessId EnumWindows FindWindowW GetWindowLongPtrW ClientToScreen GetCursorPos GetWindowRect GetClientRect ReleaseDC GetDC SetForegroundWindow GetForegroundWindow UpdateWindow GetSystemMetrics GetAsyncKeyState IsIconic SetWindowPos SetLayeredWindowAttributes UpdateLayeredWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage MessageBoxA SetWindowLongPtrW EnumDisplaySettingsW IsWindowVisible

gdi32

CreateDIBSection DeleteObject DeleteDC CreateCompatibleDC SelectObject

ws2_32

GetAddrInfoW WSAStartup FreeAddrInfoW WSACleanup InetNtopW

dwmapi

DwmFlush

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

Name

.text

Size

870KB

Virtual Size

869KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

263KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Astraeus.exe

d3d11

d3dcompiler_47

winhttp

bcrypt

ole32

shell32

advapi32

kernel32

user32

gdi32

ws2_32

dwmapi

imm32

generic