General
-
Target
Solara.exe
-
Size
7.4MB
-
Sample
240524-ragsssgc8x
-
MD5
668d1db9a3a70c9ecf654475f3369485
-
SHA1
31819dd4a5948424b3aac16e99ded3839ad7a8c1
-
SHA256
379d24f9014f75bb932c77c65f7d9508d456cba86ec45b22c542a035626140d1
-
SHA512
a2bf16b8b092326372152758d1485893aa578540fa5997041a60e03a1f527ee8cf3a38221deecb9a0d1d27561c75948241a0e08c9270a924cd3b9cb4744306e6
-
SSDEEP
196608:RrCO0cDeKG4+Ljv+bhqNVoBKUh8mz4Iv9Plu1D7AL:0ieT4CL+9qz8/b4IzuRAL
Behavioral task
behavioral1
Sample
Solara.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
Solara.exe
-
Size
7.4MB
-
MD5
668d1db9a3a70c9ecf654475f3369485
-
SHA1
31819dd4a5948424b3aac16e99ded3839ad7a8c1
-
SHA256
379d24f9014f75bb932c77c65f7d9508d456cba86ec45b22c542a035626140d1
-
SHA512
a2bf16b8b092326372152758d1485893aa578540fa5997041a60e03a1f527ee8cf3a38221deecb9a0d1d27561c75948241a0e08c9270a924cd3b9cb4744306e6
-
SSDEEP
196608:RrCO0cDeKG4+Ljv+bhqNVoBKUh8mz4Iv9Plu1D7AL:0ieT4CL+9qz8/b4IzuRAL
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-