Resubmissions

28/05/2024, 09:35

240528-lkgb5afc84 9

28/05/2024, 09:32

240528-lhsx5seb51 9

General

  • Target

    sol.zip

  • Size

    9.5MB

  • MD5

    5be4edc480659244e2df577a0881f21e

  • SHA1

    c4f70ba9dfa7520dd6a81776c7dc986d019fa1c8

  • SHA256

    1679ba54ce141473f6de54f532af61d36be7350ae066282d9edf63c21adb2d27

  • SHA512

    85cd546e88afba92ff9d20c8fc5a0bee300527434d43470aa12b6b034f421af44074f465be131a94104932d8f0d5e0b38ff537bb60b81a86894b27155ea60a6b

  • SSDEEP

    196608:6XhHXxUsKbc/r9Nvq2emPi6HyV3c0t/IihkZUE8FkiCPUgMrA8:6XhHXxUL0TC2emKx3NhV7a7PT2

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • sol.zip
    .zip

    Password: rZEtWIrUhNtYdSbY

  • README.txt
  • Solara⠀⠀.rar
    .rar

    Password: rZEtWIrUhNtYdSbY

  • Solara⠀⠀/Solara⠀Executor⠀V2⠀.exe
    .exe windows:4 windows x86 arch:x86

    Password: rZEtWIrUhNtYdSbY

    9dda1a1d1f8a1d13ae0297b47046b26e


    Code Sign

    Headers

    Imports

    Sections

  • $INTERNET_CACHE/Accessory
  • $INTERNET_CACHE/Adaptation
  • $INTERNET_CACHE/Analysis
  • $INTERNET_CACHE/Aside
  • $INTERNET_CACHE/Char
  • $INTERNET_CACHE/Chile
  • $INTERNET_CACHE/Coin
  • $INTERNET_CACHE/Concord
  • $INTERNET_CACHE/Exist
  • $INTERNET_CACHE/Exit
  • $INTERNET_CACHE/Express
  • $INTERNET_CACHE/Falling
  • $INTERNET_CACHE/Gate
  • $INTERNET_CACHE/Handhelds
  • $INTERNET_CACHE/Hz
  • $INTERNET_CACHE/Impacts
  • $INTERNET_CACHE/Leaving
  • $INTERNET_CACHE/Maldives
  • $INTERNET_CACHE/Marcus
  • $INTERNET_CACHE/Movies
  • $INTERNET_CACHE/Nigeria
  • $INTERNET_CACHE/Nr
  • $INTERNET_CACHE/Outline
  • $INTERNET_CACHE/Pa
  • $INTERNET_CACHE/Present
  • $INTERNET_CACHE/Revisions
  • $INTERNET_CACHE/Sexo
  • $INTERNET_CACHE/Sleeping
  • $INTERNET_CACHE/Summary
  • $INTERNET_CACHE/Talent
  • $INTERNET_CACHE/Topless
  • $INTERNET_CACHE/Wives
  • $INTERNET_CACHE/Yamaha
  • Solara⠀⠀/dll/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    Password: rZEtWIrUhNtYdSbY

    b9f19b4d3ce951c4ff6196681bbb3439


    Headers

    Imports

    Exports

    Sections

  • Solara⠀⠀/dll/VMProtectSDK32.lib
  • Solara⠀⠀/dll/autoexec/HOW_TO_USE.txt
  • Solara⠀⠀/dll/celeryuwp.bin
    .dll windows:6 windows x86 arch:x86

    Password: rZEtWIrUhNtYdSbY

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • Solara⠀⠀/dll/celeryuwpver
  • Solara⠀⠀/dll/uwpoff.bin
  • Solara⠀⠀/dll/uwpoffver
  • Solara⠀⠀/dll/uwpversion.txt
  • Solara⠀⠀/scripts/scripts.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: rZEtWIrUhNtYdSbY

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections