Extracted

• • Target
    AstroClient.exe
  • Size 18.9MB
  • SHA256 6035fd1a6fcced8b12a087c677ce02c7fc8517dc006e577694b5280409a68492
  • MD5 7b68fa1a03cbe4531a0aaab5a822f841
  • SHA1 3d22d764fe4d739e33174dc363804c6fc0bf1f7b
  • SHA512 3b70c4752cea76d8cb53146709a230301989ea9f4571f9248e9fdca6ca65da1e173854235563ff7fe76b1d02f6318b6bb3fe5df2bf8dc829953a82610093b873
  • SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
  • TLSH
    T1D4178E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  behavioral1behavioral2