Extracted

• • Target

    solara3.1.exe

  • Size

    231KB

  • MD5

    7340ffe16733c99a8f1904d4594951d6

  • SHA1

    1522dc62d3f4658d50f48739eb9657f4b736be3d

  • SHA256

    b5f99328387778a288470830b0e6aaaf401a55c23cd042e2a78041e10ea343b1

  • SHA512

    9d8bc3b2476c0b9499762f9cff98b3df0ef9d478f976f74a30c534fd2d09b2e14883db6c5485b5df6a9e527b5945c12f326ecc1eb4fae54c1561a0159a086245

  • SSDEEP

    6144:RloZM3fsXtioRkts/cnnK6cMlXrLwEKtFudr20VJgkTb8e1mCi:joZ1tlRk83MlXrLwEKtFudr20VJgek

  Score

  10^/10

  umbralexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1