f7ab23061e4f11a4a0f45686b971522d77219b6bf780baa56de0d435738ab93b

Sharing

Copy URL

Twitter E-mail

General

Target

Solara_Executor.rar
Size

17.0MB
Sample

240522-alts3aee76
MD5

a2da3b1a459032cb0dcb50b5b03d942b
SHA1

3cd0dca1ece13e26766faa75fed256106f57f3cb
SHA256

f7ab23061e4f11a4a0f45686b971522d77219b6bf780baa56de0d435738ab93b
SHA512

1fb16e56581368d8be4429b046f0bb4901bf97d4fb14a295af21ea18dfcbdbaad2efd5b50af6dffa6a1803c55a0760493e5fff1949195a1922758e55e8809156
SSDEEP

393216:zZb+QAO3gTUKoa4sI9YCOpjWAuPinTpOBgCcu7UopeIY01vv5:zN73jKoaXyb08PinlEJcg/plJ

Score

7^/10

Malware Config

Targets

- Target
  
  Microsoft.Web.WebView2.Core.dll
- Size
  
  488KB
- MD5
  
  851fee9a41856b588847cf8272645f58
- SHA1
  
  ee185a1ff257c86eb19d30a191bf0695d5ac72a1
- SHA256
  
  5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca
- SHA512
  
  cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f
- SSDEEP
  
  12288:W/TcW1virB3ye+iKzORFNgeA+imQ9pRFZNIEJdIElxPrEIgcvLcglxMwCepM1STy:W/1C4I
Score

1^/10
behavioral1 behavioral2
- Target
  
  Microsoft.Web.WebView2.WinForms.dll
- Size
  
  37KB
- MD5
  
  4cf94ffa50fd9bdc0bb93cceaede0629
- SHA1
  
  3e30eca720f4c2a708ec53fd7f1ba9e778b4f95f
- SHA256
  
  50b2e46c99076f6fa9c33e0a98f0fe3a2809a7c647bb509066e58f4c7685d7e6
- SHA512
  
  dc400518ef2f68920d90f1ce66fbb8f4dde2294e0efeecd3d9329aa7a66e1ab53487b120e13e15f227ea51784f90208c72d7fbfa9330d9b71dd9a1a727d11f98
- SSDEEP
  
  768:SNGbP6+wTftcZDgcEST3p4Jjrjh2jJFSUyauYv1JKia5/Zi/WGQKVu6bRaMBo0wx:OGm+otcZDgcEST3p4JjrjaJFSUyau01U
Score

1^/10
behavioral3 behavioral4
- Target
  
  Microsoft.Web.WebView2.Wpf.dll
- Size
  
  43KB
- MD5
  
  34ec990ed346ec6a4f14841b12280c20
- SHA1
  
  6587164274a1ae7f47bdb9d71d066b83241576f0
- SHA256
  
  1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409
- SHA512
  
  b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0
- SSDEEP
  
  768:1n/WlAKj4s0TV09797+nXDheteXBxc78OSW3Z8lcDP/ryEH0UBy4JjrD1h2j5h3E:1+msYXR3sZ8lcDP/ryEH0UBy4JjrD1aU
Score

1^/10
behavioral5 behavioral6
- Target
  
  Monaco/fgd.html
- Size
  
  18KB
- MD5
  
  a1416c1fe209f7687ff79ab44301b3d3
- SHA1
  
  3ba3ff0027a98128edad78f5561cef53c4236791
- SHA256
  
  a6897302dba619dd3c156d57fc4b706662bff4df582975c33478b7878b060d2c
- SHA512
  
  ce8a9aaf7ba903dfb25df53e04addfedae7ee4fcd07dffd42abf3f275a75b14cb26bb64c9320fd425003c73618b2967bb7be2cfb849050d50dd5308e69842f79
- SSDEEP
  
  384:fihTARA5Lmwl1qPeVvW4NVtabVBJjVBd+TI6noaQLR7:fihTjoy+StabVBJ/kkgoaQLR7
Score

6^/10
- Legitimate hosting services abused for malware hosting/C2
behavioral7 behavioral8
- Target
  
  Monaco/fileaccess/node_modules/.bin/mime.ps1
- Size
  
  769B
- MD5
  
  bef04abf08e89532a476c3e474b5f509
- SHA1
  
  bb81073d8e07c483ee29121358871535973336e7
- SHA256
  
  a43d8b7d57dbbb21f2f98c331970d011177fa1c6be327aa0dbb84c1ad01e9201
- SHA512
  
  e20f86c40ce523477da136cb4aa3f29683dee567a31ebfad666666192417f49568e848cb8844e8dcd32d5501fb7176d47aca54c195324e6d41e73093699788b1
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  
  Monaco/fileaccess/node_modules/finalhandler/index.js
- Size
  
  6KB
- MD5
  
  d50e9637775204f194d629000189f69c
- SHA1
  
  50d1a1725cb273b0a8e30433dabc43d65f55169b
- SHA256
  
  96900b458b12085ea16f228151439d9a7bae6b5d45248e355ad617f4dc213540
- SHA512
  
  563a8375e3ab7936162a9d209800f8b41c416c1500fe24de817871c3e5489e8faf5a4dcb7fb239f697a8736432356e60ecf1578d0aafc0de80d6e0ae90c34aad
- SSDEEP
  
  192:vMlJv4mtdenb3bGxSEhkhcC76QM6clzM8ilkv958nu4dEljyIYo4:vMom56hnw8
Score

3^/10

execution
behavioral13 behavioral14
- Target
  
  Monaco/fileaccess/node_modules/inherits/inherits_browser.js
- Size
  
  753B
- MD5
  
  184872b18b759a37285bee13cd1cd0e4
- SHA1
  
  70fcf71f449139ecbf7a5d6c78ece069bbdf4dc3
- SHA256
  
  ad322a7b1dec60f3d2ebda2091816469efb55b567d241cf3cf0fa4c5a4afe500
- SHA512
  
  0b6f853387d1ad11bc77997f278f2503ce921a5f7049978bf60b63a1e9a772238ebef67808c2132f35d6a198cb6432eb43b15769ff420b8db64959cd0a9e50cf
Score

3^/10

execution
behavioral15 behavioral16
- Target
  
  Monaco/vs/basic-languages/handlebars/handlebars.js
- Size
  
  6KB
- MD5
  
  3ca7cf83292b56444548f2914c0e1811
- SHA1
  
  4be5b1adaa187d82a94967e6960d811acd700b93
- SHA256
  
  31d25588d120e7c79f3332ff3b3c794cebd0554c7578e3bb37b3cac366e4f6c2
- SHA512
  
  2d337b64def0d42f8bd6476cf31e806f67f77d26c95c68e75574fc310f7974852a810f8b197238559a2cb20d07914de5844481477321cdcb2c68c47da9088eb8
- SSDEEP
  
  96:hFDMgRspITV1+/I/+B1BerJzlWK2BZwIBTIwbcdg6EHpf4Og6E8S6g6EB+FpAjE3:hZhbYbQRld2BZ1O0p4OE60+dMZLDs
Score

3^/10

execution
behavioral17 behavioral18
- Target
  
  Monaco/vs/basic-languages/html/html.js
- Size
  
  4KB
- MD5
  
  630fa41f59a189aed68b4db82559de95
- SHA1
  
  14a527d27240ba0effcfa43a5c46b9289e96b822
- SHA256
  
  c717ac0701d3b1e22dc52a0c53608214297e5fab7bc7011cf4e964f2eca9d62f
- SHA512
  
  e15c602788f13afd1e19e5f82de7a35eb9656950553bc3913205ba3e70ddf87199b7f9b358db7b7704efd3dc85029ad277692b6b84f5f549964b9dd7cce1ad60
- SSDEEP
  
  96:hFDMgRsfInV1+/6mQVV1+HBwBRl0GSytHd6EHaK4T6Ef6EByyEhcKMgEQEJWf:hZLP+4+GLl0GSytHLaK4ccKM2
Score

3^/10

execution
behavioral19 behavioral20
- Target
  
  Monaco/vs/basic-languages/markdown/markdown.js
- Size
  
  3KB
- MD5
  
  caf4799639d5df40dfb1b979ed68af9c
- SHA1
  
  6578ccc5111ddc190c354449be2630d91a21523b
- SHA256
  
  eaaf453e0a9f9a604547e564a24e682503189cb9b85c87715bc9b5b6492b6f62
- SHA512
  
  e787f3f849a40c608c3b35b732f16e4400c2d47e89ff309566afbc879fe37a7018722b959dc8ddc8c859d76e2f7bc0b85555cd27f7fc5e4d8e51e460ed32c9ca
Score

3^/10

execution
behavioral21 behavioral22
- Target
  
  Monaco/vs/basic-languages/razor/razor.js
- Size
  
  8KB
- MD5
  
  c87e5b4654c9011e1df9eeaa10fa4379
- SHA1
  
  25871cadcebb9eab44d65ef8483f03c6e4c44723
- SHA256
  
  2ad872aa67a12a578e652762c21136b9c9e2a741c2752d69ef48c2eb22cc621c
- SHA512
  
  aae1eb996d6c157899ea466a184b263dc4380f56615a4c69bc49a49bb30856f55374d8c7dcf159b0d0a8250c24eaa0b8a7b9a40ff2084f20b51becd3dd5e9535
- SSDEEP
  
  192:hZnmP+xRERld2BZW40v4Ou6e+vMHjIoQceC8TElNOYJXW:hYP+tsP3zkIoQceCE6JG
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  Monaco/vs/language/typescript/tsworker.js
- Size
  
  1.7MB
- MD5
  
  1e0047691c3637ad1e0da62023ba0e0d
- SHA1
  
  64902c923c2194e007bc727f7ea4f30b3a796dab
- SHA256
  
  2ccc6b6b1b5d884fe8df3e7b2f2bacca0c4529b68bbfe3c547fcc74f204cc5d1
- SHA512
  
  c1bef7bfd60acfcfb206b9631f8a730b787e94101d519d157d346d8377104d1302c0e9853ba2db944d63f03b181511950b9ea25dd21e41f40b4aeba4bc44c0c8
- SSDEEP
  
  24576:pQIJc020hIvUjQQ0s2oI4Q0s2oI4QIJc020hIvUjQQ0s2oI4Q0s2oIq:Qo3MfgfHo3Mfgfq
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  Newtonsoft.Json.dll
- Size
  
  695KB
- MD5
  
  195ffb7167db3219b217c4fd439eedd6
- SHA1
  
  1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA256
  
  e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- SHA512
  
  56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP
  
  12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
Score

1^/10
behavioral27 behavioral28
- Target
  
  WebView2Loader.dll
- Size
  
  133KB
- MD5
  
  a0bd0d1a66e7c7f1d97aedecdafb933f
- SHA1
  
  dd109ac34beb8289030e4ec0a026297b793f64a3
- SHA256
  
  79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
- SHA512
  
  2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
- SSDEEP
  
  3072:e5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdTu:e5P2e6vERtUyTmHEtmI
Score

1^/10
behavioral29 behavioral30
- Target
  
  Wpf.Ui.dll
- Size
  
  5.2MB
- MD5
  
  aead90ab96e2853f59be27c4ec1e4853
- SHA1
  
  43cdedde26488d3209e17efff9a51e1f944eb35f
- SHA256
  
  46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
- SHA512
  
  f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
- SSDEEP
  
  98304:Com1p/B6MvSmaRI+VcDNkq4pmvhAHDfyyrhl:W1HZNkq4p
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Targets

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32