MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4d3c3ffd581a9f1e9e6e7b67e18da73ea2c042455466a7e80e9457a431ec25ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CelestialRAT
Vendor detections: 11
| SHA256 hash: | 4d3c3ffd581a9f1e9e6e7b67e18da73ea2c042455466a7e80e9457a431ec25ac |
|---|---|
| SHA3-384 hash: | 81dcbdd9aacca7271cba35a0f7ac8d75024ee8bab75dbc22ea9a010b7fa362f022f1d65f1340cede84f77a36f37d7414 |
| SHA1 hash: | fae72ab3ead39c2fae9907d744ca1e6369c85995 |
| MD5 hash: | 8df9482b39a337297a4cc9792292efdc |
| humanhash: | kentucky-bluebird-blue-eleven |
| File name: | SecuriteInfo.com.Variant.Zusy.548548.28004.751 |
| Download: | download sample |
| Signature | CelestialRAT |
| File size: | 1'234'944 bytes |
| First seen: | 2025-05-26 00:42:27 UTC |
| Last seen: | 2025-05-26 01:42:36 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'653 x Formbook, 12'246 x SnakeKeylogger) |
| ssdeep | 12288:+uBSC8zeEzKlsos1NBjVOYdgK1jqM4VDje1jHC+zrf29PNI9thvKSxPy9F3RMKGc:OFeEzKlsoMjVVdgQtg |
| TLSH | T15145149C766072DFC85BC472DEA81C64EA6074BB931F5203A42716EDDA4D99BCF180F2 |
| TrID | 58.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 13.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.4% (.EXE) Win64 Executable (generic) (10522/11/4) 5.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| Magika | pebin |
| Reporter |  SecuriteInfoCom |
| Tags: | CelestialRAT exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
445
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Zusy.548548.28004.751
Verdict:
No threats detected
Analysis date:
2025-05-26 00:44:14 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
97.4%
Tags:
emotet packed virus micro
Result
Verdict:
Malware
Maliciousness:
Behaviour
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Creating a file
Creating a file in the %temp% directory
Launching a process
Creating a process from a recently created file
Enabling the 'hidden' option for recently created files
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
BSOD occurred
Unauthorized injection to a recently created process
Firewall traversal
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
base64 confuser confuserex hacktool lolbin obfuscated obfuscated packed reconnaissance remote
Verdict:
Malicious
Labled as:
Zusy.Generic
Verdict:
Malicious
Result
Threat name:
Celestial Rat
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Celestial Rat
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Score:
99%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Backdoor.FormBook
Status:
Malicious
First seen:
2025-05-26 00:43:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
20 of 24 (83.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
4d3c3ffd581a9f1e9e6e7b67e18da73ea2c042455466a7e80e9457a431ec25ac
MD5 hash:
8df9482b39a337297a4cc9792292efdc
SHA1 hash:
fae72ab3ead39c2fae9907d744ca1e6369c85995
SH256 hash:
d985739de3f770df2b198ca067d84ac8f138bab55e60dc82c83935af22c3c9d7
MD5 hash:
3241513810b1fb0fd32c554990558f36
SHA1 hash:
f670cef1a83b96bfba5c1451342b32fe41f328b0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | BLOWFISH_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for Blowfish constants |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__RemoteAPI |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | Detect_PowerShell_Obfuscation |
|---|---|
| Author: | daniyyell |
| Description: | Detects obfuscated PowerShell commands commonly used in malicious scripts. |
| Rule name: | INDICATOR_EXE_Packed_ConfuserEx |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with ConfuserEx Mod |
| Rule name: | Lumma_Stealer_Detection |
|---|---|
| Author: | ashizZz |
| Description: | Detects a specific Lumma Stealer malware sample using unique strings and behaviors |
| Reference: | https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/ |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.