{
  "family": "celesty",
  "sample_count": 34,
  "category": "trojan",
  "description": "Celesty (often referenced as Celesty Binder or Celesty RAT) is a malicious utility designed to bundle multiple executable files together and facilitate remote backdoor access. As a binder, it takes a clean, legitimate host file (like a PDF reader or image viewer installer) and merges it with a hidden malicious payload. When the user executes the resulting hybrid file, both the legitimate application and the malware run simultaneously, heavily masking the malicious activity. The payload frequently dropped is the Celesty RAT, a feature-rich Remote Access Trojan capable of comprehensive system surveillance. The RAT can log keystrokes, manage files, manipulate the Windows Registry, and establish a persistence mechanism via the Startup folder or Run keys. Due to its dual nature as both a binder and a RAT, Celesty has been popular among amateur cybercriminals and script kiddies who rely on social engineering to trick victims into executing seemingly benign files.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Celesty Binder",
    "Celesty RAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What does Celesty do?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It acts as both a file binder to camouflage malware and a RAT to provide unauthorized remote access."
      }
    },
    {
      "@type": "Question",
      "name": "What is a file binder?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A tool that combines a malicious executable with a benign file so the user is unaware of the infection when running it."
      }
    },
    {
      "@type": "Question",
      "name": "What are the RAT capabilities of Celesty?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It includes file browsing, process management, registry editing, and keystroke logging."
      }
    },
    {
      "@type": "Question",
      "name": "How does Celesty maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It typically adds registry keys in the Windows Run hive to ensure it starts upon system boot."
      }
    },
    {
      "@type": "Question",
      "name": "Is it considered advanced malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, it is generally used by low-level threat actors and is well-detected by modern endpoint protection platforms."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "Unknown"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Celesty binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Celesty installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.Celesty",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.win32.celesty"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2012-0158 Details",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0158"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2004,
  "motivation": "Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "lineage": {
    "derived_from": [
      "delphi_binder_rat_framework"
    ],
    "variants": [
      "celesty_v2.1",
      "celesty_binder"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2012-0158",
    "CVE-2015-1641"
  ],
  "iocs": {
    "file_hashes": [
      "e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2",
      "f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3"
    ],
    "delivery": [
      "Trojanized game cracks and bundled executables combined using Celesty Binder",
      "Underground forum sharing and peer-to-peer file sharing networks"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CelestyServer",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SystemTrayAgent"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}