General

  • Target

    SolaraB (9).zip

  • Size

    6KB

  • Sample

    240618-kzbvhs1ajp

  • MD5

    8a570fb447cebcf20f18229b07a52174

  • SHA1

    6ee43d73656f1072a24ebeb424d60d4477368cec

  • SHA256

    f21280ccc887f6956119238872943a3f6567294645ea666c59d3ac5fea2ee592

  • SHA512

    86c6d5e88f7883682463417da0b54446fae389bdc1e61552037607b9b3dd8c7978a75bd3fb983bbc90ba10a436482e4964a39d7e801336a8109ba1d2de3fe838

  • SSDEEP

    96:fq43b11j3vs+ieHBgcCXhzWYQ1NJGQ7S8SnV8xT/KiFlg5YNwMHv5OAKWpCnUJ:i4rEKhgcghDY4Q7WV8t/VG11A5CQ

Malware Config

Targets

    • Target

      SolaraB (8)/SolaraB/Solara/SolaraBootstrapper.exe

    • Size

      13KB

    • MD5

      6557bd5240397f026e675afb78544a26

    • SHA1

      839e683bf68703d373b6eac246f19386bb181713

    • SHA256

      a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239

    • SHA512

      f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97

    • SSDEEP

      192:konexQO0FoAWyEfJkVIaqaLHmr/XKT0ifnTJ1jvVXctNjA:HnexHAWyEfJoIaqayzKAifd1LVEj

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks