Overview

overview

8

Static

static

3

SolaraBoot...er.exe

windows7-x64

7

SolaraBoot...er.exe

windows10-2004-x64

8

SolaraBoot...er.pyc

windows7-x64

3

SolaraBoot...er.pyc

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SolaraBootstrapper.exe

  • Size

    20.6MB

  • Sample

    240526-zlnz9ace75

  • MD5

    85e8c5acfc113792ea950f0f9974dde6

  • SHA1

    b98fd74d3e1f9277ba3fbdf70821c41bd8b553aa

  • SHA256

    6b5bc20646f1d8c2b40dcaa0d716d6fa8aa25589c54043cf0fa547a21d10fcf4

  • SHA512

    9e86d41b77de5e5290b3e66d75c620a2ca86d8166474ca743948b62e186d350433eecbd5c6c7212cdce24bf11d5ee7213127ecbd773ad9112af507747afeb021

  • SSDEEP

    393216:1o9DM45Ct55L1V8dkurEUWj+rM6EGPKSUuK+:a9NMXRndbmM64S7K+

Score
8/10
executionpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      SolaraBootstrapper.exe

    • Size

      20.6MB

    • MD5

      85e8c5acfc113792ea950f0f9974dde6

    • SHA1

      b98fd74d3e1f9277ba3fbdf70821c41bd8b553aa

    • SHA256

      6b5bc20646f1d8c2b40dcaa0d716d6fa8aa25589c54043cf0fa547a21d10fcf4

    • SHA512

      9e86d41b77de5e5290b3e66d75c620a2ca86d8166474ca743948b62e186d350433eecbd5c6c7212cdce24bf11d5ee7213127ecbd773ad9112af507747afeb021

    • SSDEEP

      393216:1o9DM45Ct55L1V8dkurEUWj+rM6EGPKSUuK+:a9NMXRndbmM64S7K+

    Score
    8/10
    upxexecutionspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

    • Target

      SolaraBootstrapper.pyc

    • Size

      44KB

    • MD5

      9f241419142904350c75b6b7efc989a5

    • SHA1

      3f17c020abcdc918171bd234dcfba603ac0dcf17

    • SHA256

      9aad9ba8c5c99d686bfe97c913e58c5490d7c1c00a66a03346f05c65aefafe69

    • SHA512

      80e688059f563e873685b522c428cd1df908affa462a507ba524916899fe4cbeb20df74958749f0389597bd92a67c17f81768537bf5184ff647c6088ccbb54dd

    • SSDEEP

      768:n9JWUQ4PFDea6iMVqD62oP2ASzvrLJHaj9bmJACa06hYFUDlhLx3QpJ6y:n9JWN0FDea9sG6sAg/J6j9xaUDlhLxA9

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks