!,ʴ�7BTuv؇(��{�X�=�P�>��Pԟ�haNZ����5������㲸�W�*������M�*�Ԁ����ti�},t��v�8%�y�0ᔫ�g����ΪQ��Uw��D��M��[�ԵJ[�Г������̓�-צًL����%-����I<j�b���+x�I�"[۶����$%�W�Y>HS�,�E�x5��,N-�"���c\�ֱֆ*8���KJK�S4H����� kv���{�����D�DN��% �,�,)w��&���~'5��W?r�0DA���.����2Xt��H��$�y�{��:�;8mh�o� Fԥ�ԉ��.���({/�v�(0|�VX�N6a�dk�;��<�F����f��aC��V��E���'��F��� Uo�Q& ���,&2����ћ��[���6��iYˎ�1���i� g�&��/�rwt���i���ҭD��[ �q��m�ߡz�+��3>jX긢y�iv��+��01V§q�n;��'���f����|ze��SZ궾{����d\��-+��eB�?>��⛸�EG��)@$g�?���1�6����|M���q?�J�F�7�w��l�X1�;c�s��}/��,d�v<�FK���FÜ�{��h�%��m�<�fv% ����3K��y���jfT��pȳ�KX�é����9c7�}N��k}��s�xk��*�5��V�Vi�����|v\h�gV�����1 ��~�p� 2JB8*R�Y���h�39��l�5 z�Ś`*|�b���[�KZBf�-�n8���̉�e-�uб�� ���ڻErh��B;�� ��1}�M�Zl6��w�}28.��I���*K�T���SM��������X)~m��%I�&Ӛ�M�{�T� j��R�h �ʚ�/F ��8Q��%�?*�CԄ �C{��1r�l���Yv��4*ұ�F[9�}�}�n�t}ː0V)��X���������U�sM�٦Л�dQ��%I}���(V�\�a�ס��R��|�ʎ��*�/ʐEb�(���#�1{�����:Ǻ�l�R��Ak�Gۦ���K�Ӟ�DaiT_��5���B���j��$��D@K#��<?��������uTM��e��tB���Dd��y� ���u��7KD���C�X6dwUQA��=��S��̮Oz����%�f��e�+U�K3Y���q*(y���v�^�&�_ -��_hz����� �y����=����<T���48'2�Wdl6��߃�����k}P37���`�\EK�YqfA��œ&;���Q�´�ދ�\���(|�5�x�hLFx:AAv+uZ$��XuH��<� Ԍ�'���}�{�O����eÁ�� �N�5�Чt�^վ�̄YfT�@m��v��(.;զZx.�9�a�F��x�}�(��/���� V��@ ����ҫ�;kK/�D�����7֜��n��:�K��щ��F�{�?5���|��:��� A�~�@{�j6�V�,�J�5M�'�l~LU(���ا;t����S5E��ާT�/�ie�p�3`���y5�y��UƄ�q+{�v�96b�6�ʒ�&�Z�ͳ�]��@873 L���@XnT�-?�b�� ˙�����p%F<s��{�n2���zX���0P�Uϵb�����M8~͕������n�3�5�:����[�WJ���9�(�m��"���&Fꓨ�B�/v!�s���"w߀)�Co�JoI�@�� 8���z�Z����k�[������e�`�C��W�{�FُM� �+��:�9�������$�e��}�<�ՙ=8z���D�������p���v�A}>t%�HFw'!��;�R�n�lŦ��S����?��D)���rV��]�8�[!���u���FYu<��(#h�8j��nw��tj�d���(���OՈ>��b�}lSH�3xl��/�;kH���2��,��)���!�Z�N��q:�0A�\���]�HP��K���4>��fc��%��d�0'0��L�|�»�D�f������"AZ��гo���P} e�ķU.��JT��K���U��3��T�U��`Q��O������r�|rr� ����/>*�܀#�S���N��GE�v��-��Y�N�'oB��\�UR�r�i�JI���H^[�W��̅e�e�����������c����gj ���J77����&�A�q[�$�.�im��Ј������Bn�6KA������h�5��Z��B�03A�� ��h�ەZ�iK�>UITƈj���N��4��Y�,4�f���&�{�|D��#s�쓤C���8Օ��I5?��s���xr��.n�b���f��D�G݄.j��c"Gr;l"0��2W�ʂ��m�c�h�G��I^Xb�ǽ37~YsDS���B��n�+�W5�v�W�ul>�MP,���&��*��=/+�V��W?�"���YXR�2�9��RE� �6J������s;�'5��qg�������j�,���Ş�)!��n����?V��vHЇ��?�_��[��ڙi���0���ͥ��VJt�K�e>�9��|���������ʂz�<��5j��g�ܨ��HD�B�Sf<c��o�~�5Nn�xqk��� &�uߙ�1�� մ�P�&�ݍ:&�@���Y�4Ɖ;�t�c`�ËΗ%�P��L�ː}�J�X;w�pM���"�8#şR1���o�+)���]{���Ex�ձ� >U��X1FE�2���Mɚ��Y2+Ls�7'�R�7w��p��huq�� ���� 0�|wۉ�HP���@�5��ح7��_���f���ie��Au�O2��������E��QզRh�Q��T'��ަ��6}g߸ �ú���'��֤)2�|�y�<Ԥ�J��m�w݄1��u��ٝ�4�wS�MW�>����'�va��Q����-�OmVz|�E�1G�._͍�n�5�%3��\�o�)�c�M���0u��Co5�:�t��Q������V����I�҅��Fׇ6�\�L��E
Static task
static1
Behavioral task
behavioral1
Sample
solaris_2.0.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
solaris_2.0.exe
Resource
win10v2004-20240508-en
General
-
Target
solaris_2.0.exe
-
Size
5.8MB
-
MD5
42c1de8f644ba81ab336c70f338a99c2
-
SHA1
4fd27b16d33c5580d07bd94770b4ed29a409c924
-
SHA256
b35536ddbf8add8364840a6409e0e5a2be59dd66563160a0dd81dff45acfa3d9
-
SHA512
c2edfb9a9f79bc501d6e5533b0fdc26da18770b1ce5ce834026105863435878a201acd88610f7a0e69bd72f152af6c9330c72b51a5c556a28b2131af9db847b0
-
SSDEEP
98304:jARAClqssPxrxIpIQxAa7bAwL4cI/q10/m5Cl+jQcVXVVx24wH00Kt6:jEZlx6rxCfAibhL/oN/XSJJ8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource solaris_2.0.exe
Files
-
solaris_2.0.exe.exe windows:6 windows x64 arch:x64
67bb9fb2cd63879a3c29fba183bf9788
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
SleepEx
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClientRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetTokenInformation
imm32
ImmReleaseContext
msvcp140
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord60
crypt32
CertOpenStore
ws2_32
WSAIoctl
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
acosf
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 724KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 886KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.solaris Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.solaris Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ