Solara_Updater[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
Solara_Updater.rar
Size 4.5MB
Sample240613-jyedksthpp
SHA256 45f89521d997335ed82d5daf6952d2ac9f0418d7206b124d1f3b8aba611f1739
MD5 480de8719c81f7af7568c43cc5e49d78
SHA1 dfd6bffc3d1ea875dbb75368dc5cb2d641ae6446
SHA512 2fbf1d09cdf203c8e365b351b24c0e8297018f00ac719a11a457f12138391db67e30355aad83b5efbe21efe16287a25f25ea8ea78c377ee8b96c27e8127aa1ed
SSDEEP 98304:z2lW1L7iJs1nUv1AyAYJ+1DNUtpAamjfz0PNng65c6naWzFg9oanvgT:z2JHqY84t6amboPt/cezFg9pc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/SolaraUpdater.exe	vmprotect

File Explorer

Solara_Updater.rar

.rar 4.5MB
SolaraUpdater.exe

.exe 4.7MB

Solara_Updater.rar

SHA256 45f89521d997335ed82d5daf6952d2ac9f0418d7206b124d1f3b8aba611f1739
MD5 480de8719c81f7af7568c43cc5e49d78
SHA1 dfd6bffc3d1ea875dbb75368dc5cb2d641ae6446
SHA512 2fbf1d09cdf203c8e365b351b24c0e8297018f00ac719a11a457f12138391db67e30355aad83b5efbe21efe16287a25f25ea8ea78c377ee8b96c27e8127aa1ed
SSDEEP 98304:z2lW1L7iJs1nUv1AyAYJ+1DNUtpAamjfz0PNng65c6naWzFg9oanvgT:z2JHqY84t6amboPt/cezFg9pc
MD5 SHA1 SHA512 SSDEEP

Password

solara

SolaraUpdater.exe

IMPHASH cc5bd577c62da1977cfced9869bb1afa
SHA256 841f58be56dc3b74ffd29221c50e4571802f86e62d5ceae9a77c966dd4966c25
MD5 f43ffcc95602f501c8ca74f97c94e5c0
SHA1 8ac706553c3fe03195e797d9c0ca3d51a0cdca94
SHA512 6ca7952795f22457edb2bf7360799301e77166703f6ef6cae613e52c7ba0edca2360a5a9d93772febc8d8a18294f253cc959be740c0a881599f080165f58f6db
SSDEEP 98304:GVJ3X7WmteiflexgI7nNB7AENUDyIbJZk/crwxEG8cXda1el:43RtxfOF7NVAkUtrwxeyV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Password

solara

PE Signature issue

Digest

55:84:9c:5e:db:76:a4:8d:2c:66:72:29:54:8e:e4:b8:2d:fa:bd:7f:71:6b:82:3c:74:55:39:d3:99:82:7f:ab

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Chains

May 6, 2024

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Serial Number

0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 2, 2021 - Jul 10, 2024

Subject

CN=Dummy certificate

Serial Number

Issuer

CN=Dummy issuer

Timespan

Jan 1, 2013 - Apr 1, 2013

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6163231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

shell32

ShellExecuteA

msvcrt

__argc __argv _environ _XcptFilter memset __set_app_type _controlfp __getmainargs exit

kernel32

SetUnhandledExceptionFilter VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

wtsapi32

WTSSendMessageW

user32

GetProcessWindowStation GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetUserObjectInformationW

��:Xs�*E��m�Ь��v@��ism��1��z:_Z�iؕ��L�|;;�>m,,�ӄc��0��+�~aU죬��P�f��-�]=��0T��L +~��߶%��i'ȼ�.etܚ*)��8�=SAh�߼[FrLDV�4��[�sQ;�g+c=�E�ۜ��Pz�;��iN��"-��,��J񸠢u��I;�-��Q��C��g��~��@[�J��l"��}Б��&�WZN{�N��[`�$S ll�exfXa)t ��Q[��qw^�Uf{��{�e0U[|o�s�U֗�بe��Ȱ^��s�wQ��L�~�<�EFT�K�1�+QT�`t�ߦ��2��Ǽ�D��Q�L:��r%\�y.��O�?��M }XP�-��[O��`��p�=X�"��̄l�G4�� ǐ�҄�,��"�E��n��J��<K�Bg��y� ,�4�FTg|��e6��{��K�A!��X��Ʊ��O��³��TDwc��k}�T��j��/��q�R��%?K��NO��9�8u��j�n��NY��H�ڐt�>�!�F��p��/'}Pg, ��ٌ�۫�?��$��#��q/�+��1� ��%�v.ܩ|H�G�ov�݇c��ةH�9��{�r�4��k�<�oc?*��,;:u8�!8D��x��'�͠eZiZ��O��R�H�xȊ�ѱ�[c~GE��$7\>��t�7K h�~�)ϴ�b �ߵh�L�ʽ0��]�˭E�<�81%GY��gi ��+��đ�*Z]M">W��vm�!��M�@��B��$��C�v̖%��6�̌om��*3�9}-g�p)�M�f��"Sl�g0�� '}-�E��T��|_�r�<� o��$xEr��n2Fh)b0�L��+W��E�yۧ-[\&R��{�>�om�s`-g��H��o��p�K�W�؏D)�h��ۘ/��)a��,o��k�o��Cn�w��O�{&}H;a;*��[0)��'�_m>;�p�b�p��J��"��ҥ#N�j�֣�Xm *$@��j<(��XP��G �L*6�T�>�FQL��KWl%�F�ݚ�T'Cç��4`c��@h�d*��3``JS)��c:�-`DIg��.��*�/�}��N��.>�qH��g-A��^��I�IQ�~�j�"4`=8+}��@��L��P+M9z�j��྆��j�WNd70�ɶ�'_��|^��?�:��4��Y�.qk\��#��h~��nf'��XMD"6�qˡ�~��s�)=��~=ۭA�ф�+��;�fS�3�k��=�6< �@E��ed��=�A�"J��@|�[�{��!wX�>��K�t�Z��H��$B��v@��_� {$��*N�Ô6'��}��e��԰Wh��/'%  ��*IOG��0+�!gE�1E�[B��B�*\�ݹ�� ]��nh^�,��1}��L��$�{D�!��(��ulqw�tĢ�O �ǚVĬ�WR��D6�1��^�o g�b:FY\D��gM��9ac*��~��_��=&�g�B��ǎ�(FG\�b�%�ti>:ƍx/��d5_A�}>�ޯ�ڽ!/� �KU�qG��+�a`�� +�|1��\��^ܮe;}��6Z ��^Ӿ�&�j��2��]��_�Ĳw}��>I23�=�3i��T]A�3��C��0\�O�v�ɜ!�U��x�>��FZj�˔�H�L3fvU'b��&��+;�P��E�"J��_��P�ZTs�'W��^��%S�� \'�*-bg��o(�x��G.�Ϥk;��(�FN�Q��ss��S�'�\e��YFK��ȴG !0�(9"vtZMz��ݟ1�c{�(O�+��L�f'ڡ>��ff��=P��g�J��Y�=Mv�f��D�"��eh��UM��I��v��c��-P|��͋S^�KDP�Α.��<RHd`S�a٨L��}�lҵ��j ��u��{�V��b��V�/FWQ�}_�Z>M{y^��G��K ��NA�+t�&l��a��C}��C'$mYm��#IB��7N�V��oث�{=P��ω�J��i��n�á�{�F0��!2��VR!��*v�v��_ä��F��*��&�Cȼ$l��n��s��-8�XBrDX��5��.�� ?�]<i ��t06j��)��;�+��]r��:��&�)�p��L�Y�Hc ��P{��"-&�A#:V݂,?��'�!#h��xP̡�fj��@�g��otֿa�9<$�1��uH��pg�aC�*��/G�6�fj^�i�@֖��0��tГĖ�|��{�zj�H��7(��.�}��@��*\=�+�"��ͮ�.��y�R�Yy��܎E��t��c��[T�pP"�~6�w"|pt80]�/y~�8�R��r�b��:��r��c>�#�O-�mt��\�i�E%NI��PZ�Y3h��zBԂ8�[D��oGYL�DX�2ˮ�o��L��haI�v:uK#J`� z�d]?��e�S�u�ǇJ� �!9m�"Ͳ��f ��;�f��5YK�J͑[�i竮e��^��/��NZ^(�L��v�w��ъp��Ȉ��zL��Z,��*nEFF��T��W�HOc��E�|��r�0��-��}�� ,&��?�A_LT^q ��8X��و�<�0M�u��6��;y�P��0:��z��W��m�(��|�U�(�D�L��>�O-N;Hre��ՙ+F�_okx{��[V?��aq{�q��!�EԻ�)�

Name

.text

Size

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Solara_Updater.rar

SolaraUpdater.exe

PE Signature issue

shell32

msvcrt

kernel32

wtsapi32

user32

generic