Overview

overview

10

Static

static

10

SolaraBoot...er.exe

windows11-21h2-x64

8

Resubmissions

09/06/2024, 16:27

240609-tx6rjsda96 10

09/06/2024, 16:24

240609-twrk8sda79 10

09/06/2024, 16:19

240609-tsneeacc4z 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    SolaraBootStrapper.exe

  • Size

    6.0MB

  • Sample

    240609-tx6rjsda96

  • MD5

    8116bbdd585cd77142af18b129be88bb

  • SHA1

    a7cb5f61964d58983cfbb6b4b40e6e374b03554b

  • SHA256

    7f1008902303a85f114a65fdb57c3a0e202eac406d1123018213875c8584e8de

  • SHA512

    b72bd356997c0449c9362e708ec7856b6928c74ad642092ed9152e7f096b244d36dab5f2a99a7d4a29487affd7ff31e6df8dbfb259b47e19f20993aba94e11bd

  • SSDEEP

    98304:5rgBIu4+DcBOBamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HfMlx3J2:5rgOp+Dd8eNoInY7/sHfbRy9UloUO

Score
10/10
blankgrabberexecutionspywarestealerupx

Malware Config

Targets

    • Target

      SolaraBootStrapper.exe

    • Size

      6.0MB

    • MD5

      8116bbdd585cd77142af18b129be88bb

    • SHA1

      a7cb5f61964d58983cfbb6b4b40e6e374b03554b

    • SHA256

      7f1008902303a85f114a65fdb57c3a0e202eac406d1123018213875c8584e8de

    • SHA512

      b72bd356997c0449c9362e708ec7856b6928c74ad642092ed9152e7f096b244d36dab5f2a99a7d4a29487affd7ff31e6df8dbfb259b47e19f20993aba94e11bd

    • SSDEEP

      98304:5rgBIu4+DcBOBamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HfMlx3J2:5rgOp+Dd8eNoInY7/sHfbRy9UloUO

    Score
    8/10
    executionspywarestealerupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks