Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    SolaraB (2).zip

  • Size

    5KB

  • Sample

    240605-t1xcaaca8z

  • MD5

    1dda11cf804307d4e3725764be9d62c6

  • SHA1

    bfc3100ea03067a069b9417695aab7c6951d1346

  • SHA256

    662ac096440ba88fd9a8c647b4ba01ed2199aa30d9ff8435c45dcd4899dac0d1

  • SHA512

    e6486ec14c6d43c1d8b0cd91cf13c4c6561407190f241a6bc7d782e6f7e8eb2484cf83bdb4218b2a83d465d38c70963b72f4a10b5cbf95fd9b9d5d8273a4f8fc

  • SSDEEP

    96:S643b11j3vs+ieHBgcCXhzWYQ1NJGQ7S8SnV8xT/KiFlg5YNwMHv5Nb:S64rEKhgcghDY4Q7WV8t/VG1ob

Malware Config

Targets

    • Target

      SolaraB/SolaraB/Solara/SolaraBootstrapper.exe

    • Size

      13KB

    • MD5

      6557bd5240397f026e675afb78544a26

    • SHA1

      839e683bf68703d373b6eac246f19386bb181713

    • SHA256

      a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239

    • SHA512

      f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97

    • SSDEEP

      192:konexQO0FoAWyEfJkVIaqaLHmr/XKT0ifnTJ1jvVXctNjA:HnexHAWyEfJoIaqayzKAifd1LVEj

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks