General
-
Target
Solara.exe
-
Size
1.1MB
-
Sample
240618-xf51gavamh
-
MD5
55eb5d4d4503bb44933d8e307db0dc96
-
SHA1
aa3f5ba2fc28c3a6c9f1cc538ccbe2c62f73f3eb
-
SHA256
1ac539099498a1b248611e9a8c493486cafc55abf4360f7279a753ae9b6b3b40
-
SHA512
12fadc72d7f905353274b1ba83cc160babd7a2f029fecb4220296a5db03b253592b7ef28b646a7a47076df02a500cbbf0ac7e893f1475f47bacceca35069ebd8
-
SSDEEP
24576:22G/nvxW3WiA9xhFfxb6kuyZ7EsX0tVK6rDvrIls:2bA3yVzuJsXLk
Behavioral task
behavioral1
Sample
Solara.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Solara.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
Solara.exe
-
Size
1.1MB
-
MD5
55eb5d4d4503bb44933d8e307db0dc96
-
SHA1
aa3f5ba2fc28c3a6c9f1cc538ccbe2c62f73f3eb
-
SHA256
1ac539099498a1b248611e9a8c493486cafc55abf4360f7279a753ae9b6b3b40
-
SHA512
12fadc72d7f905353274b1ba83cc160babd7a2f029fecb4220296a5db03b253592b7ef28b646a7a47076df02a500cbbf0ac7e893f1475f47bacceca35069ebd8
-
SSDEEP
24576:22G/nvxW3WiA9xhFfxb6kuyZ7EsX0tVK6rDvrIls:2bA3yVzuJsXLk
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-