Overview

overview

7

Static

static

3

SolaraBoot...er.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SolaraBootstrapper.exe

  • Size

    12KB

  • Sample

    240521-rdwfcsge57

  • MD5

    74494703e5f44eeb9aa037f0f50bf682

  • SHA1

    fcfd8813e63cd61c5bfd2db605827fb9070fe8e9

  • SHA256

    3e4f692506d372bebc12d344c5f1543b67fa1dbe095c910aab78456510d7fe66

  • SHA512

    dbd2a8d928c797c70c4286d8ebabe202902445ed60e94eeccf33c7e3d794c7e362139187dcd1a57a4919503c1c791cfbe38f6f6eff454248382b3c4e023791fe

  • SSDEEP

    192:WrnDHbLupIapaLPr/XKnxxTc1l6VXtrNjA:WrnzHUIapazzKxm1cVdZj

Score
7/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      SolaraBootstrapper.exe

    • Size

      12KB

    • MD5

      74494703e5f44eeb9aa037f0f50bf682

    • SHA1

      fcfd8813e63cd61c5bfd2db605827fb9070fe8e9

    • SHA256

      3e4f692506d372bebc12d344c5f1543b67fa1dbe095c910aab78456510d7fe66

    • SHA512

      dbd2a8d928c797c70c4286d8ebabe202902445ed60e94eeccf33c7e3d794c7e362139187dcd1a57a4919503c1c791cfbe38f6f6eff454248382b3c4e023791fe

    • SSDEEP

      192:WrnDHbLupIapaLPr/XKnxxTc1l6VXtrNjA:WrnzHUIapazzKxm1cVdZj

    Score
    7/10
    evasionthemidatrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks