General

  • Target

    SolaraV4.rar

  • Size

    11.1MB

  • MD5

    ff05181c01d5dd2699f88e19069a1f9b

  • SHA1

    03d911e20bcab1b6301907ae392347320e654553

  • SHA256

    7ab5b365874e86c90f3b06f333cacb49edd671d2d27d85776bd3c882c551647f

  • SHA512

    92e7818fa27997450e48b23a0d017c97e1cb7234a35517c528e05f58e25f179fda633b088b6eaa8bb6a58e758e424eea8ca40e4df1a9aa6d606186479fe879c9

  • SSDEEP

    196608:JCTOMzDwT5PcxGW5AmbbuSQ9zLPwxFxEfUMEtZjMe2zw6cmhgbfHTy5/KTs:JHM4Txcxh/bC9vPix5DZjPH65hgbfzqD

Score
10/10

Malware Config

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Blankgrabber family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • SolaraV4.rar
    .rar

    Password: infected

  • README.txt
  • Solara.dll
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Solara.json
  • Solara.runtimeconfig.json
  • SolaraV4.exe
    .exe windows:5 windows x64 arch:x64

    Password: infected

    f4f2e2b03fe5666a721620fcea3aea9b


    Code Sign

    Headers

    Imports

    Sections

  • ��'���.pyc
  • autoexec.lnk
    .lnk
  • bin/SolaraAuth.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    1e43248867d3aa00b36c87eacf058544


    Headers

    Imports

    Exports

    Sections

  • scripts/saved_tabs/tab_1
  • workspace.lnk
    .lnk