General

  • Target

    Solara.exe

  • Size

    1.1MB

  • Sample

    240618-xg768avaqb

  • MD5

    55eb5d4d4503bb44933d8e307db0dc96

  • SHA1

    aa3f5ba2fc28c3a6c9f1cc538ccbe2c62f73f3eb

  • SHA256

    1ac539099498a1b248611e9a8c493486cafc55abf4360f7279a753ae9b6b3b40

  • SHA512

    12fadc72d7f905353274b1ba83cc160babd7a2f029fecb4220296a5db03b253592b7ef28b646a7a47076df02a500cbbf0ac7e893f1475f47bacceca35069ebd8

  • SSDEEP

    24576:22G/nvxW3WiA9xhFfxb6kuyZ7EsX0tVK6rDvrIls:2bA3yVzuJsXLk

Score
10/10

Malware Config

Targets

    • Target

      Solara.exe

    • Size

      1.1MB

    • MD5

      55eb5d4d4503bb44933d8e307db0dc96

    • SHA1

      aa3f5ba2fc28c3a6c9f1cc538ccbe2c62f73f3eb

    • SHA256

      1ac539099498a1b248611e9a8c493486cafc55abf4360f7279a753ae9b6b3b40

    • SHA512

      12fadc72d7f905353274b1ba83cc160babd7a2f029fecb4220296a5db03b253592b7ef28b646a7a47076df02a500cbbf0ac7e893f1475f47bacceca35069ebd8

    • SSDEEP

      24576:22G/nvxW3WiA9xhFfxb6kuyZ7EsX0tVK6rDvrIls:2bA3yVzuJsXLk

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks