Aero Star NoAuth[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Aero Star NoAuth.exe
Size 6.6MB
Sample260930-zy471avydt
SHA256 b38f41c775b7ff0a16aa7b5e1b06a28f542394b058c55a348d8be379bf3b6906
MD5 3f7e98085055aafac6681aee466d6a53
SHA1 98bc30e667a0b4ab0689821c60469f789eb330c5
SHA512 f4617692f66ec38215cf2e7120260b2e6ba5dd50e63a38ee576e1d72075062c85005735c22645cea3acb31771fcacc42e1fb49051abf81fc2e00a6615729ae00
SSDEEP 98304:huu1ywRDIBdrZDzxDDrZiQUkGOUUkx8wSRCleBk08w4GKhD4s49:hu6pRMBj97ZiQUkGOUUk1lCkW4t9T4
TLSH
T17666BE6296AC469DE026F038C2975617E3F1BC0D1321DFCF96D09D671E2FAD0B67A209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Aero Star NoAuth.exe

File Explorer

Aero Star NoAuth.exe

.exe 6.6MB

Aero Star NoAuth.exe

IMPHASH bff876d4350c291fe4294dddd94541c2
SHA256 b38f41c775b7ff0a16aa7b5e1b06a28f542394b058c55a348d8be379bf3b6906
MD5 3f7e98085055aafac6681aee466d6a53
SHA1 98bc30e667a0b4ab0689821c60469f789eb330c5
SHA512 f4617692f66ec38215cf2e7120260b2e6ba5dd50e63a38ee576e1d72075062c85005735c22645cea3acb31771fcacc42e1fb49051abf81fc2e00a6615729ae00
SSDEEP 98304:huu1ywRDIBdrZDzxDDrZiQUkGOUUkx8wSRCleBk08w4GKhD4s49:hu6pRMBj97ZiQUkGOUUk1lCkW4t9T4
TLSH
T17666BE6296AC469DE026F038C2975617E3F1BC0D1321DFCF96D09D671E2FAD0B67A209
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4498384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

user32

ReleaseCapture IsWindowUnicode SetCursorPos GetCapture ClientToScreen TranslateMessage DispatchMessageA PeekMessageA SetCapture SetCursor UnregisterClassW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow SetWindowPos SetWindowDisplayAffinity GetAsyncKeyState GetSystemMetrics UpdateWindow SetActiveWindow GetForegroundWindow SetForegroundWindow MessageBoxA GetWindowLongPtrW SetWindowLongPtrW FindWindowA LoadCursorA LoadIconW PostMessageA PostQuitMessage GetMessageExtraInfo GetKeyState TrackMouseEvent SetProcessDPIAware GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard AnimateWindow IsZoomed GetClientRect DefWindowProcW GetCursorPos ScreenToClient GetWindowRect keybd_event OpenClipboard

shell32

ShellExecuteW ShellExecuteA SHGetFolderPathA ord680

winmm

joyGetDevCapsW PlaySoundA joyGetNumDevs joyGetPosEx

crypt32

CertFindCertificateInStore CryptStringToBinaryW CertOpenStore CertEnumCertificatesInStore CertGetNameStringW CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CryptProtectData PFXImportCertStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CryptDecodeObjectEx CertFindExtension CryptUnprotectData

wintrust

WinVerifyTrust

hid

HidD_GetPreparsedData HidD_GetHidGuid HidD_GetAttributes HidP_GetCaps HidD_FreePreparsedData

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList

ole32

CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CoInitializeEx

bcrypt

BCryptHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

msvcp140

?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??7ios_base@std@@QEBA_NXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z _Cnd_unregister_at_thread_exit _Cnd_register_at_thread_exit _Cnd_broadcast _Cnd_wait ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Xbad_function_call@std@@YAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?setf@ios_base@std@@QEAAHHH@Z ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Mtx_unlock _Mtx_lock _Thrd_yield _Thrd_detach _Query_perf_frequency _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

wininet

HttpOpenRequestA InternetCloseHandle InternetConnectA InternetReadFile HttpQueryInfoA HttpSendRequestA InternetOpenA InternetSetOptionA

advapi32

OpenProcessToken CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash GetTokenInformation RegCloseKey RegOpenKeyExW RegQueryValueExW CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW StartServiceW CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptGetHashParam CryptCreateHash CryptHashData

ws2_32

select recvfrom sendto htonl listen accept ioctlsocket __WSAFDIsSet freeaddrinfo inet_pton inet_ntop getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect closesocket WSAGetLastError ntohs WSASetLastError bind connect getpeername getsockname getaddrinfo gethostname htons recv setsockopt socket WSAIoctl

oleaut32

SafeArrayGetUBound SysFreeString SysAllocString SafeArrayGetLBound SafeArrayGetElement VariantInit VariantClear

kernel32

PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW IsDebuggerPresent OutputDebugStringW ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete FindClose FormatMessageW SetLastError FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW EnterCriticalSection GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionEx CreateFileMappingA UnmapViewOfFile MapViewOfFile GetThreadContext SetThreadPriority GetCurrentThread CreateThread ExitProcess Sleep CloseHandle GetFileAttributesA GetEnvironmentVariableA DeleteFileW GetModuleHandleA GetFileAttributesW GetProcAddress LoadResource LockResource LeaveCriticalSection GetFileType SetFileAttributesW GetTempPathW OutputDebugStringA GetLastError WaitForSingleObject GetCurrentProcess GetExitCodeProcess CreateProcessW GetSystemDirectoryW GetModuleHandleW GetEnvironmentVariableW CreateDirectoryW GetFileSizeEx ReadFile WriteFile LocalFree FreeLibrary LoadLibraryA WideCharToMultiByte OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetStdHandle FlushFileBuffers SetHandleInformation CreatePipe QueryPerformanceCounter HeapAlloc HeapFree GetProcessHeap TerminateProcess VirtualAlloc GetModuleFileNameW DeleteFileA GetFileInformationByHandle GetModuleFileNameA SetFileInformationByHandle CreateFile2 AreFileApisANSI CopyFile2 GetFileInformationByHandleEx WakeAllConditionVariable GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetTickCount64 WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive FindResourceW InitializeCriticalSection LoadLibraryW SleepEx MoveFileExW GetTickCount SizeofResource CreateFileW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar VerSetConditionMask QueryPerformanceFrequency GetLocaleInfoA CreateFileA FindResourceA FreeConsole

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140

_purecall memset memmove memcpy memchr _CxxThrowException __std_exception_destroy wcsstr longjmp __std_exception_copy wcschr __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp strchr strrchr __std_terminate strstr memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strspn _strdup wcspbrk strcspn isdigit wcsncmp strpbrk strncpy_s wcsncpy strlen strncpy _wcsicmp strncmp strcmp strcpy_s tolower wcslen

api-ms-win-crt-runtime-l1-1-0

_exit abort _crt_atexit __sys_nerr __sys_errlist _cexit _c_exit _beginthreadex terminate _initterm exit _seh_filter_exe _set_app_type _invoke_watson _initterm_e _errno _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _initialize_narrow_environment _wassert _initialize_onexit_table _configure_narrow_argv _register_onexit_function

api-ms-win-crt-heap-l1-1-0

malloc realloc _callnewh calloc free _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoul strtol wcstombs strtoull strtoll strtod atoi

api-ms-win-crt-stdio-l1-1-0

fputc fgetc fread _wfopen fsetpos fclose _get_stream_buffer_pointers __stdio_common_vsscanf _fseeki64 fwrite setvbuf fgetpos __stdio_common_vfprintf __acrt_iob_func ungetc __p__commode __stdio_common_vsprintf _close fgets _fileno _write _lseeki64 _read __stdio_common_vsprintf_s _set_fmode ftell fseek _wopen ferror feof fopen_s __stdio_common_vsnprintf_s fflush fputs

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _fstat64 _unlink _lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

tanhf exp sqrt sin cos atan2 asin acosf ceilf pow ldexp tanf __setusermatherr _fdopen roundf powf cosf expf floorf fmod fmodf sinf sqrtf

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-time-l1-1-0

strftime _gmtime64 _time64