General
-
Target
SolaraB (9).zip
-
Size
6KB
-
Sample
240618-kzbvhs1ajp
-
MD5
8a570fb447cebcf20f18229b07a52174
-
SHA1
6ee43d73656f1072a24ebeb424d60d4477368cec
-
SHA256
f21280ccc887f6956119238872943a3f6567294645ea666c59d3ac5fea2ee592
-
SHA512
86c6d5e88f7883682463417da0b54446fae389bdc1e61552037607b9b3dd8c7978a75bd3fb983bbc90ba10a436482e4964a39d7e801336a8109ba1d2de3fe838
-
SSDEEP
96:fq43b11j3vs+ieHBgcCXhzWYQ1NJGQ7S8SnV8xT/KiFlg5YNwMHv5OAKWpCnUJ:i4rEKhgcghDY4Q7WV8t/VG11A5CQ
Static task
static1
Behavioral task
behavioral1
Sample
SolaraB (8)/SolaraB/Solara/SolaraBootstrapper.exe
Resource
win7-20240220-en
Malware Config
Targets
-
-
Target
SolaraB (8)/SolaraB/Solara/SolaraBootstrapper.exe
-
Size
13KB
-
MD5
6557bd5240397f026e675afb78544a26
-
SHA1
839e683bf68703d373b6eac246f19386bb181713
-
SHA256
a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239
-
SHA512
f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97
-
SSDEEP
192:konexQO0FoAWyEfJkVIaqaLHmr/XKT0ifnTJ1jvVXctNjA:HnexHAWyEfJoIaqayzKAifd1LVEj
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-