General
- Target AstraScreenShare-Instalador-2.7.32.exe
- Size 93.0MB
- Sample261113-e64k8azx5l
- SHA256 17fd236ec621b5fc63dd1e1edb4436525589ab9c00211169b48dd9a9f59e8c75
Malware Config
Targets
-
- Target AstraScreenShare-Instalador-2.7.32.exe
- Size 93.0MB
- SHA256 17fd236ec621b5fc63dd1e1edb4436525589ab9c00211169b48dd9a9f59e8c75
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Network Share Discovery
Attempt to gather information on host network.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target AstraScreenShare.exe
- Size 200.7MB
- SHA256 22ad71fdcd96eedfde0b18cab737aed3d114bcf39d1ea84bd31d38fb8beb0723
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Network Share Discovery
Attempt to gather information on host network.
-
- Target LICENSES.chromium.html
- Size 14.5MB
- SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
Score1/10 -
- Target dxcompiler.dll
- Size 24.7MB
- SHA256 d8a6ff71c310c934cc859e3e9b1a2c34b0f38253bdc258c1476cbd9ccb633e37
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
Score1/10 -
- Target ffmpeg.dll
- Size 2.9MB
- SHA256 5c8c4804c266b3c0bd1517c42f9dd310c3733fc14c363fc151306166295af238
Score1/10 -
- Target libEGL.dll
- Size 492KB
- SHA256 09dc89e7a401f272d29ef445f1825f4ef4422c6844892a6d8a56108b47a69504
Score1/10 -
- Target libGLESv2.dll
- Size 7.7MB
- SHA256 e5d96fb54dfbbf676b0b37c7915bcd907ff28f2ba63b49a72736a43ba3939a4e
Score1/10 -
- Target resources/astra-audio.exe
- Size 735KB
- SHA256 8c5b761bf052a47539e640f0157069745cbad8098fce6a80496dc9e188c86880
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vk_swiftshader.dll
- Size 5.3MB
- SHA256 22a2305e52d6cded30c0606c7cb44e25c1374dbbec08f5da183f91de0b1390a4
Score1/10 -
- Target vulkan-1.dll
- Size 917KB
- SHA256 457ac4472ea01cdc7bf483629eed2118814611c79e39ea69304adb2509fe28ec
Score1/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10 -
- Target $R0/Uninstall AstraScreenShare.exe
- Size 238KB
- SHA256 219447340e5ed8cd68983fb34a9229f6e83dc1867a399f735acffd37849d9250
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
7System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1