Overview

overview

10

Static

static

9

08.06.2024...y].zip

windows7-x64

1

08.06.2024...y].zip

windows10-2004-x64

1

OPEN ME.rar

windows7-x64

3

OPEN ME.rar

windows10-2004-x64

3

SolaraX.exe

windows7-x64

10

SolaraX.exe

windows10-2004-x64

10

dll/VMProt...32.dll

windows7-x64

1

dll/VMProt...32.dll

windows10-2004-x64

3

dll/VMProt...32.lib

windows7-x64

3

dll/VMProt...32.lib

windows10-2004-x64

3

dll/autoex...SE.txt

windows7-x64

1

dll/autoex...SE.txt

windows10-2004-x64

1

dll/celeryuwp.dll

windows7-x64

1

dll/celeryuwp.dll

windows10-2004-x64

1

dll/celeryuwpver

windows7-x64

1

dll/celeryuwpver

windows10-2004-x64

1

dll/uwpoff.bin

windows7-x64

3

dll/uwpoff.bin

windows10-2004-x64

3

dll/uwpoffver

windows7-x64

1

dll/uwpoffver

windows10-2004-x64

1

dll/uwpversion.txt

windows7-x64

1

dll/uwpversion.txt

windows10-2004-x64

1

scripts/scripts.dll

windows7-x64

1

scripts/scripts.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08.06.2024 Updated Ver 3.2 PC [no key].zip

  • Size

    9.6MB

  • Sample

    240608-vgqwtsde6t

  • MD5

    c6d1f63c7f1b52ebea21777fe14bd76f

  • SHA1

    d24be8079674e99130b3f65022f8f501dd9a1cbb

  • SHA256

    529804cf8e209aebaa8561fdca5ddd0d9d834b6c490266293380108298eac7e5

  • SHA512

    09662630c251c342fca791cfdeeb8c00d114fe70ee5d3ea724fd814f490cda4ff17e62852c806ebeb7f32f06c0edfe7383e74c6b1e3ce0d36c2f733c1173ea5a

  • SSDEEP

    196608:94dxwBHWwKSMT5srIxB/7Mwvv4oawO7Qgs3fX/Wa2acdWLSTvq3:GYBqCr2vvv4oaP7Qgs3fxBuWLSG3

Score
10/10
cryptonediscoverypackerspywarestealer

Malware Config

Targets

    • Target

      08.06.2024 Updated Ver 3.2 PC [no key].zip

    • Size

      9.6MB

    • MD5

      c6d1f63c7f1b52ebea21777fe14bd76f

    • SHA1

      d24be8079674e99130b3f65022f8f501dd9a1cbb

    • SHA256

      529804cf8e209aebaa8561fdca5ddd0d9d834b6c490266293380108298eac7e5

    • SHA512

      09662630c251c342fca791cfdeeb8c00d114fe70ee5d3ea724fd814f490cda4ff17e62852c806ebeb7f32f06c0edfe7383e74c6b1e3ce0d36c2f733c1173ea5a

    • SSDEEP

      196608:94dxwBHWwKSMT5srIxB/7Mwvv4oawO7Qgs3fX/Wa2acdWLSTvq3:GYBqCr2vvv4oaP7Qgs3fxBuWLSG3

    Score
    1/10
    behavioral1behavioral2

    • Target

      OPEN ME.rar

    • Size

      9.6MB

    • MD5

      91f3b852870d86f9dbeef1197e87ce6e

    • SHA1

      7fce336d77e7f7ddd51599d6dcf6248d77f8c563

    • SHA256

      e3c14a5dba1814561693a12ded038310002f6d414846a2fd995ac0d442bd4992

    • SHA512

      c6b5ca0b403e62b1d07027074c93363f4fc6188a5dcc7713b0552229abcd1bd7a2550e15717637dbe462dafff76a66f72995a32977d9822ab9badf64b743758d

    • SSDEEP

      196608:T4dxwBHWwKSMT5srIxB/7Mwvv4oawO7Qgs3fX/Wa2acdWLSTvqU:sYBqCr2vvv4oaP7Qgs3fxBuWLSGU

    Score
    3/10
    behavioral3behavioral4

    • Target

      SolaraX.exe

    • Size

      250.0MB

    • MD5

      43bf6761d9dae68bd74831601ed7c893

    • SHA1

      5fab84533586c5f89dba5aa18d87c70c8232934a

    • SHA256

      03b46ab2bbb60cf08080797d38013fcc4af520a19d45694ecfef45bb16fd79a6

    • SHA512

      825649294b9d9718ce79787cbfc7f7311e83aa6cf063f4a08d7c32b729288828eb7ceb87c5055591e60a66f3a95e9247e7c8b47fd87776406305723edf7b6f4d

    • SSDEEP

      24576:rqTXmyMZ4H78iXpGqUgjT/Lh0NuFbEPnbrTGDE39gR6xdaCg:2FdXgxkTT6NuFw/TGDsXLad

    Score
    10/10
    discoveryspywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral5behavioral6

    • Target

      dll/VMProtectSDK32.dll

    • Size

      98KB

    • MD5

      7ff7f1e0cc2bb5a6eac9c21762ee66b2

    • SHA1

      8e8b1e55c1ae4c6d07c79d120182acd3a5db64d5

    • SHA256

      ac25bf2734049c16094a1b0d5c1749d11f10f2655d59fa6cfe923e12956f2074

    • SHA512

      f29c814f327f379a72823bbae55d0fd3df792f7d4f21cd8939f7fab266d3cb8e075c05938da667d4d674b30d61ff088f2c9b55cf822471f65cd2ae3a52ababe9

    • SSDEEP

      1536:rT33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdw/0YXowGF:lhQC2mCYK3RhrZ9dPk2Q9yMJw/0YRG

    Score
    3/10
    behavioral7behavioral8

    • Target

      dll/VMProtectSDK32.lib

    • Size

      7KB

    • MD5

      60558b29db81ad274a8f992882932426

    • SHA1

      eccc072b4fb1bb9204b633be4a6c2d783e71a2a9

    • SHA256

      9278d85fde55f645cafc39946b1832985b85fb6aac23938edf0c6d5ad3027109

    • SHA512

      1b1a6364942309811108b1f1a34e465f0415848d8ec557879c7c4522b13ba594130a224f5055262e1fc8a94aa96c9f5fb037f5a1b1936b2ebf09b3199e358678

    • SSDEEP

      96:UCm/+uYlVlOKU3A/hknkbKJKSKU//DjnK:9VlN/hNyy

    Score
    3/10
    behavioral10behavioral9

    • Target

      dll/autoexec/HOW_TO_USE.txt

    • Size

      161B

    • MD5

      4324149d23c0d89f490249e531460c21

    • SHA1

      96a44574a5c71d923e91e6cc3e8a7eb7a9727755

    • SHA256

      a6f1509ddeb9b80f94e3ec9de3821bb129979201c6833f472d25fab16187c1ee

    • SHA512

      c8c49722367d49ffb540cda2ed3fe955027050f810b0e05a501030c2ea5dff44f1a12ccb94c3d982dbadb9f5211ed199cc81d8457fd2821433975261e1c5c82e

    Score
    1/10
    behavioral11behavioral12

    • Target

      dll/celeryuwp.bin

    • Size

      4.2MB

    • MD5

      b0f566fc20de341e2848a489f69a4e48

    • SHA1

      7a81ab4c68ddeb1e0a83c37e17286ae53e29c334

    • SHA256

      5223f453b44be5d13f5f249f1f23b020b75c7e237c23712d97813c430015afc6

    • SHA512

      4ba8394bede49de1dd1ad98afa59e0546b5118cf6b75dcf2cc83f00fde88bda0d659944c3324d19960d935d9e29e69f8b9b08fa5d5db7f71506e13471bbcb75f

    • SSDEEP

      49152:LikvPpFjV8b8bhnNcZXGDQc6jg8mHdnYvLyv5ttr24Y4AxYWAF7yWGxmR/qSDQey:0ZXGU7k8Ol5/24PqNmOQ

    Score
    1/10
    behavioral13behavioral14

    • Target

      dll/celeryuwpver

    • Size

      3B

    • MD5

      cb5ae17636e975f9bf71ddf5bc542075

    • SHA1

      180505679cfe0cca79bae51fdda0296b7cd9c493

    • SHA256

      14be4b45f18e0d8c67b4f719b5144eee88497e413709d11d85b096d8e2346310

    • SHA512

      957f720b6d516c8e273968c9be2ffbe146329c1a11a2097844206f030dfde1f4efe3379eb68316d1c7426457144d9576dad04e46b10c0ca8d8b9a5d668387a1b

    Score
    1/10
    behavioral15behavioral16

    • Target

      dll/uwpoff.bin

    • Size

      5KB

    • MD5

      f6bd9ca8a75d0e07cfd57177cf7bdab3

    • SHA1

      a876290038821ce7ae8d14e3db3286323f22caa7

    • SHA256

      6b1f4c2089b4086bdfd8b11e90721baffe74ddad2240c787e0245e49e93ac332

    • SHA512

      3b1521a404c47c795d2c960bc3edb5e91cc5e598da3c135c16d46b74dd59a0d3dd44c4dc3158f347489b283a7194bf100389cfeb87d8379e6fcc791705fbfb1a

    • SSDEEP

      48:SClA9KbxnWqU6o+MKd2kbcrzQUuPIKtcuMj18SYlt+gtXvsY9W2XApEdF0/JxNyV:nlAkbAeo+BcPNuMuLlhtX7ptv0/H9Cww

    Score
    3/10
    behavioral17behavioral18

    • Target

      dll/uwpoffver

    • Size

      3B

    • MD5

      cb5ae17636e975f9bf71ddf5bc542075

    • SHA1

      180505679cfe0cca79bae51fdda0296b7cd9c493

    • SHA256

      14be4b45f18e0d8c67b4f719b5144eee88497e413709d11d85b096d8e2346310

    • SHA512

      957f720b6d516c8e273968c9be2ffbe146329c1a11a2097844206f030dfde1f4efe3379eb68316d1c7426457144d9576dad04e46b10c0ca8d8b9a5d668387a1b

    Score
    1/10
    behavioral19behavioral20

    • Target

      dll/uwpversion.txt

    • Size

      5B

    • MD5

      f0016f1d09aea25afcb3fb5948acbb9f

    • SHA1

      5151f95ad805265d9169fb020297c97b589a90cb

    • SHA256

      cc1a4126ba1a738f56187a2a2a9df4f3d3f6baa8dc966feed9d0f6e09a5a486a

    • SHA512

      da19cc04a0a6cc175f056ce4bb5091cb1f7a4efa922704ddedce2aa7dbfda8e53709a81206234744d8ef34c97fd1a31ea0f62ecd41ed7977064dc5ece36477ef

    Score
    1/10
    behavioral21behavioral22

    • Target

      scripts/scripts.dll

    • Size

      18.7MB

    • MD5

      88fd7dbf04bcf75123d02009aea3f7f7

    • SHA1

      cecf16bdad71e54afc941179ea2b7438a04efa1d

    • SHA256

      01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4

    • SHA512

      2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917

    • SSDEEP

      393216:hqA/D2IIyzg8DolBo6i0KoI6Di42sC1/syU3DXNs6hq8:hqcaZyV0fC1JOpjhq8

    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

6
T1082

Process Discovery

1
T1057

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks