Extracted

Extracted

Extracted

• • Target

    Solara-Executor

  • Size

    304KB

  • MD5

    517f63f72eade402b33b49d155c78bfa

  • SHA1

    61ab7528b8b247714d6a70312f09b28682e7c500

  • SHA256

    8e2f032d0ff15f2c9bab0f9f894936066c42f388a5e891ed76e4e7cb9ff2e365

  • SHA512

    8c62582aa300bbec3ab45485843875ec52af0a6c34dd04e91fd981008ffb57a8112c0bd5449c7e281f3b83a6d5cdda7f9c94c1909590c98a17c62743d7e213ac

  • SSDEEP

    6144:D6ozv2n9dH5M2vkm0aFRv3pId9RY9AvZJT3CqbMrhryfQNRPaCieMjAkvCJv1ViT:mozv2n9dH5M2vkm0aFRv3pId9RY9AvZn

  Score

  10^/10

  discordratlummaumbralexecutionpersistenceratrootkitstealer

  • Detect Umbral payload

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2