star.zip
- SHA256 da49d8860aa6fce3cc3833903562c7ebadb443018e1a42dd203b922511cdb224
Behavioral task
behavioral1
Sample
star.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
star.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
star_jewhunting.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral4
Sample
star_jewhunting.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target star.zip
- Size 6.7MB
- Sample260910-h65p3azdnf
- SHA256 da49d8860aa6fce3cc3833903562c7ebadb443018e1a42dd203b922511cdb224
- MD5 23ef44ca03edfced8e2d412bc8d09115
- SHA1 d293adf179bf8f2a0b5ee70375212b2a78dd18f8
- SHA512 5cb75031f31193a4ea8ce33b79b130d6805219890c1c383b8cfd5f231df69ff9038c068e881802e9bee9d828c1450c9dbc217e45c44f9fdfdb06a886b99e1384
- SSDEEP 196608:Ani9+uFEIxJTK0//HNQmBdGbTaTrpz5pJx2EY7YRs/sEdj1rb9:ei9S0//tjS0pj2tZ5
- TLSH T116663368C9740DD6181117E4354AACD6B4ADF37953FACE0BFB534E1C88BEEF824A4258
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/star.exe vmprotect - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/star.exe unpack001/star_jewhunting.exe
File Explorer
-
star.zip.zip 6.7MB
-
star.exe.exe 6.8MB
-
star_jewhunting.exe.exe 493KB
star.exe
- IMPHASH 49bcfc596b31f28bd4a4aa0cb6584a99
- SHA256 e41ff6c5fa373f9c458ba7b49da437c7aebc54b48073c1bb67dbe945dc9e2b80
- MD5 b79980583d0c6d97606599017fdbb109
- SHA1 285b72409ef1f346a26b5097e6dfe7452032dd80
- SHA512 13f557e6c0b96bd2357808cc4b915886d15adf779bd01d49514d05f245e5c737fd9aa8e0835e25f99143ccb1efcac4836467338765c525f2e4bcada6b38fbadc
- SSDEEP 196608:u+PRg4P31WEdRHzQm/lqpN+TxLOH9eQa/4miz:ujEdRTRShde
- TLSH T1CE76239E614C3758C81AC5B89433AC4972BA531D8BE999AF71CBFFC037DB910D602B49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10961217
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
api-ms-win-security-base-l1-1-0
AdjustTokenPrivileges
api-ms-win-core-processthreads-l1-1-0
CreateRemoteThread
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-toolhelp-l1-1-0
Process32NextW
api-ms-win-core-psapi-ansi-l1-1-0
K32GetModuleBaseNameA
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-psapi-l1-1-0
K32GetModuleBaseNameW
api-ms-win-core-memory-l1-1-0
VirtualProtectEx
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
api-ms-win-mm-time-l1-1-0
timeEndPeriod
api-ms-win-ntuser-sysparams-l1-1-0
EnumDisplayDevicesW
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
api-ms-win-core-com-l1-1-0
CoInitializeEx
api-ms-win-core-file-l1-1-0
SetFileTime
mfplat
MFCreateAttributes
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
mfreadwrite
MFCreateSourceReaderFromURL
iphlpapi
GetAdaptersInfo
api-ms-win-core-file-l1-2-2
GetTempFileNameA
api-ms-win-core-errorhandling-l1-1-0
SetLastError
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-heap-l2-1-0
GlobalFree
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
d3dcompiler_47
D3DCompile
api-ms-win-core-localization-l1-2-0
GetLocaleInfoA
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
shell32
Shell_NotifyIconW
msvcp140
?_Incref@facet@locale@std@@UEAAXXZ
ntdll
ZwWriteVirtualMemory
d3d11
D3D11CreateDeviceAndSwapChain
wininet
HttpQueryInfoA
dwmapi
DwmUpdateThumbnailProperties
comdlg32
GetOpenFileNameW
advapi32
GetSidSubAuthorityCount
user32
RegisterClassW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
kernel32
GetFileAttributesW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
imm32
ImmSetCandidateWindow
gdi32
DeleteObject
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-environment-l1-1-0
_wgetenv
wtsapi32
WTSSendMessageW
Name
.text
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
683KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.vmp0
Size
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp1
Size
6.8MB
Virtual Size
6.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
star_jewhunting.exe
- IMPHASH 7f4b60553283073334f4d27a1d2da3c0
- SHA256 64b5f1fe5d8593a2cee70d3b3a562b31a506e840ecd729531f7994c626c9bdcc
- MD5 5cf46a151c4c4aab5916b62f2ca72dfe
- SHA1 43641d9fdef2df3b945e1ac7b1c60b869402dc3c
- SHA512 3d0248e5c7b9126909bc428cce06c783bb920265f38a1a2d5af9fa100e88a6ab42d7c5399fa2d95a4bc36d3e9eb11be03bd910bdc068bb9369cfb8661136c100
- SSDEEP 6144:ZIXYXaam0O0d+AoVHsl5R5dm+m02BktZrdwSE5BENzCucxiltMojGmu9zR0:ZIkHoVMl5RjE0ektZr2SzNz0itMz
- TLSH T1B7B47C05F7A100F9E5B7C178C9A64502EB32BC855371ABDF23E49A9A1F23BD09E39711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
95712
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
OpenServiceW
ControlService
DeleteService
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
CryptReleaseContext
ws2_32
htonl
htons
setsockopt
recv
ntohs
socket
WSACleanup
accept
bind
closesocket
select
ntohl
listen
inet_pton
WSAStartup
send
secur32
QueryContextAttributesW
AcquireCredentialsHandleW
FreeCredentialsHandle
DeleteSecurityContext
AcceptSecurityContext
EncryptMessage
DecryptMessage
crypt32
PFXImportCertStore
CryptAcquireCertificatePrivateKey
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertCreateCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
iphlpapi
DeleteUnicastIpAddressEntry
CreateUnicastIpAddressEntry
GetExtendedTcpTable
InitializeUnicastIpAddressEntry
GetAdaptersAddresses
kernel32
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
GetFileAttributesExW
CreateDirectoryW
ReadFile
SizeofResource
SetConsoleCtrlHandler
WriteFile
TerminateProcess
GetTempPathW
CreateFileW
GetFileAttributesW
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
LockResource
DeleteFileW
Process32FirstW
CloseHandle
LoadLibraryW
LoadResource
FindResourceW
SetCurrentDirectoryW
GetProcAddress
GetFileSize
ExitProcess
GetCurrentProcessId
FreeLibrary
WideCharToMultiByte
QueryFullProcessImageNameW
SetDllDirectoryW
SetConsoleTitleW
GetLocaleInfoW
LCMapStringW
CompareStringW
LoadLibraryExW
VirtualProtect
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetSystemTimeAsFileTime
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
IsProcessorFeaturePresent
GetCurrentProcess
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetFileSizeEx
SetFilePointerEx
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapFree
HeapAlloc
RtlUnwind
ncrypt
NCryptFreeObject
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
Name
.text
Size
240KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
140KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=35222,
count=18, id=260, version=35222,
count=7, id=259, version=35222,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=259, version=35721,
count=17, id=260, version=35721,
count=92, id=261, version=35721,
count=15, id=257, version=35222,
count=188, id=1, productName=Unmarked objects,
count=1, id=265, version=36256,
count=1, id=255, version=36256,
count=1, id=151,
count=1, id=258, version=36256,