f7ab23061e4f11a4a0f45686b971522d77219b6bf780baa56de0d435738ab93b

Sharing

Copy URL Twitter E-mail

General

Target
Solara_Executor.rar
Size 17.0MB
Sample240522-alts3aee76
SHA256 f7ab23061e4f11a4a0f45686b971522d77219b6bf780baa56de0d435738ab93b
MD5 a2da3b1a459032cb0dcb50b5b03d942b
SHA1 3cd0dca1ece13e26766faa75fed256106f57f3cb
SHA512 1fb16e56581368d8be4429b046f0bb4901bf97d4fb14a295af21ea18dfcbdbaad2efd5b50af6dffa6a1803c55a0760493e5fff1949195a1922758e55e8809156
SSDEEP 393216:zZb+QAO3gTUKoa4sI9YCOpjWAuPinTpOBgCcu7UopeIY01vv5:zN73jKoaXyb08PinlEJcg/plJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  Microsoft.Web.WebView2.Core.dll
- Size 488KB
- SHA256 5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca
- MD5 851fee9a41856b588847cf8272645f58
- SHA1 ee185a1ff257c86eb19d30a191bf0695d5ac72a1
- SHA512 cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f
- SSDEEP 12288:W/TcW1virB3ye+iKzORFNgeA+imQ9pRFZNIEJdIElxPrEIgcvLcglxMwCepM1STy:W/1C4I
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  Microsoft.Web.WebView2.WinForms.dll
- Size 37KB
- SHA256 50b2e46c99076f6fa9c33e0a98f0fe3a2809a7c647bb509066e58f4c7685d7e6
- MD5 4cf94ffa50fd9bdc0bb93cceaede0629
- SHA1 3e30eca720f4c2a708ec53fd7f1ba9e778b4f95f
- SHA512 dc400518ef2f68920d90f1ce66fbb8f4dde2294e0efeecd3d9329aa7a66e1ab53487b120e13e15f227ea51784f90208c72d7fbfa9330d9b71dd9a1a727d11f98
- SSDEEP 768:SNGbP6+wTftcZDgcEST3p4Jjrjh2jJFSUyauYv1JKia5/Zi/WGQKVu6bRaMBo0wx:OGm+otcZDgcEST3p4JjrjaJFSUyau01U
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  Microsoft.Web.WebView2.Wpf.dll
- Size 43KB
- SHA256 1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409
- MD5 34ec990ed346ec6a4f14841b12280c20
- SHA1 6587164274a1ae7f47bdb9d71d066b83241576f0
- SHA512 b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0
- SSDEEP 768:1n/WlAKj4s0TV09797+nXDheteXBxc78OSW3Z8lcDP/ryEH0UBy4JjrD1h2j5h3E:1+msYXR3sZ8lcDP/ryEH0UBy4JjrD1aU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Monaco/fgd.html
- Size 18KB
- SHA256 a6897302dba619dd3c156d57fc4b706662bff4df582975c33478b7878b060d2c
- MD5 a1416c1fe209f7687ff79ab44301b3d3
- SHA1 3ba3ff0027a98128edad78f5561cef53c4236791
- SHA512 ce8a9aaf7ba903dfb25df53e04addfedae7ee4fcd07dffd42abf3f275a75b14cb26bb64c9320fd425003c73618b2967bb7be2cfb849050d50dd5308e69842f79
- SSDEEP 384:fihTARA5Lmwl1qPeVvW4NVtabVBJjVBd+TI6noaQLR7:fihTjoy+StabVBJ/kkgoaQLR7
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10
- Legitimate hosting services abused for malware hosting/C2
behavioral7 behavioral8
- Target
  Monaco/fileaccess/node_modules/.bin/mime.ps1
- Size 769B
- SHA256 a43d8b7d57dbbb21f2f98c331970d011177fa1c6be327aa0dbb84c1ad01e9201
- MD5 bef04abf08e89532a476c3e474b5f509
- SHA1 bb81073d8e07c483ee29121358871535973336e7
- SHA512 e20f86c40ce523477da136cb4aa3f29683dee567a31ebfad666666192417f49568e848cb8844e8dcd32d5501fb7176d47aca54c195324e6d41e73093699788b1
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  Monaco/fileaccess/node_modules/finalhandler/index.js
- Size 6KB
- SHA256 96900b458b12085ea16f228151439d9a7bae6b5d45248e355ad617f4dc213540
- MD5 d50e9637775204f194d629000189f69c
- SHA1 50d1a1725cb273b0a8e30433dabc43d65f55169b
- SHA512 563a8375e3ab7936162a9d209800f8b41c416c1500fe24de817871c3e5489e8faf5a4dcb7fb239f697a8736432356e60ecf1578d0aafc0de80d6e0ae90c34aad
- SSDEEP 192:vMlJv4mtdenb3bGxSEhkhcC76QM6clzM8ilkv958nu4dEljyIYo4:vMom56hnw8
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Monaco/fileaccess/node_modules/inherits/inherits_browser.js
- Size 753B
- SHA256 ad322a7b1dec60f3d2ebda2091816469efb55b567d241cf3cf0fa4c5a4afe500
- MD5 184872b18b759a37285bee13cd1cd0e4
- SHA1 70fcf71f449139ecbf7a5d6c78ece069bbdf4dc3
- SHA512 0b6f853387d1ad11bc77997f278f2503ce921a5f7049978bf60b63a1e9a772238ebef67808c2132f35d6a198cb6432eb43b15769ff420b8db64959cd0a9e50cf
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Monaco/vs/basic-languages/handlebars/handlebars.js
- Size 6KB
- SHA256 31d25588d120e7c79f3332ff3b3c794cebd0554c7578e3bb37b3cac366e4f6c2
- MD5 3ca7cf83292b56444548f2914c0e1811
- SHA1 4be5b1adaa187d82a94967e6960d811acd700b93
- SHA512 2d337b64def0d42f8bd6476cf31e806f67f77d26c95c68e75574fc310f7974852a810f8b197238559a2cb20d07914de5844481477321cdcb2c68c47da9088eb8
- SSDEEP 96:hFDMgRspITV1+/I/+B1BerJzlWK2BZwIBTIwbcdg6EHpf4Og6E8S6g6EB+FpAjE3:hZhbYbQRld2BZ1O0p4OE60+dMZLDs
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Monaco/vs/basic-languages/html/html.js
- Size 4KB
- SHA256 c717ac0701d3b1e22dc52a0c53608214297e5fab7bc7011cf4e964f2eca9d62f
- MD5 630fa41f59a189aed68b4db82559de95
- SHA1 14a527d27240ba0effcfa43a5c46b9289e96b822
- SHA512 e15c602788f13afd1e19e5f82de7a35eb9656950553bc3913205ba3e70ddf87199b7f9b358db7b7704efd3dc85029ad277692b6b84f5f549964b9dd7cce1ad60
- SSDEEP 96:hFDMgRsfInV1+/6mQVV1+HBwBRl0GSytHd6EHaK4T6Ef6EByyEhcKMgEQEJWf:hZLP+4+GLl0GSytHLaK4ccKM2
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Monaco/vs/basic-languages/markdown/markdown.js
- Size 3KB
- SHA256 eaaf453e0a9f9a604547e564a24e682503189cb9b85c87715bc9b5b6492b6f62
- MD5 caf4799639d5df40dfb1b979ed68af9c
- SHA1 6578ccc5111ddc190c354449be2630d91a21523b
- SHA512 e787f3f849a40c608c3b35b732f16e4400c2d47e89ff309566afbc879fe37a7018722b959dc8ddc8c859d76e2f7bc0b85555cd27f7fc5e4d8e51e460ed32c9ca
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Monaco/vs/basic-languages/razor/razor.js
- Size 8KB
- SHA256 2ad872aa67a12a578e652762c21136b9c9e2a741c2752d69ef48c2eb22cc621c
- MD5 c87e5b4654c9011e1df9eeaa10fa4379
- SHA1 25871cadcebb9eab44d65ef8483f03c6e4c44723
- SHA512 aae1eb996d6c157899ea466a184b263dc4380f56615a4c69bc49a49bb30856f55374d8c7dcf159b0d0a8250c24eaa0b8a7b9a40ff2084f20b51becd3dd5e9535
- SSDEEP 192:hZnmP+xRERld2BZW40v4Ou6e+vMHjIoQceC8TElNOYJXW:hYP+tsP3zkIoQceCE6JG
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Monaco/vs/language/typescript/tsworker.js
- Size 1.7MB
- SHA256 2ccc6b6b1b5d884fe8df3e7b2f2bacca0c4529b68bbfe3c547fcc74f204cc5d1
- MD5 1e0047691c3637ad1e0da62023ba0e0d
- SHA1 64902c923c2194e007bc727f7ea4f30b3a796dab
- SHA512 c1bef7bfd60acfcfb206b9631f8a730b787e94101d519d157d346d8377104d1302c0e9853ba2db944d63f03b181511950b9ea25dd21e41f40b4aeba4bc44c0c8
- SSDEEP 24576:pQIJc020hIvUjQQ0s2oI4Q0s2oI4QIJc020hIvUjQQ0s2oI4Q0s2oIq:Qo3MfgfHo3Mfgfq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  WebView2Loader.dll
- Size 133KB
- SHA256 79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
- MD5 a0bd0d1a66e7c7f1d97aedecdafb933f
- SHA1 dd109ac34beb8289030e4ec0a026297b793f64a3
- SHA512 2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
- SSDEEP 3072:e5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdTu:e5P2e6vERtUyTmHEtmI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  Wpf.Ui.dll
- Size 5.2MB
- SHA256 46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
- MD5 aead90ab96e2853f59be27c4ec1e4853
- SHA1 43cdedde26488d3209e17efff9a51e1f944eb35f
- SHA512 f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
- SSDEEP 98304:Com1p/B6MvSmaRI+VcDNkq4pmvhAHDfyyrhl:W1HZNkq4p
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32