Extracted

• • Target

    SolaraB/SolaraBootstrapper.exe

  • Size

    13KB

  • MD5

    8be476fb431fcf11156417f410acf978

  • SHA1

    55a19def82358ffc006487e1f49be04277e12bd5

  • SHA256

    14cf7648123e018dcdfc2aa386135a0510a9f7b12b8bc125ad4e32fd7f16999c

  • SHA512

    cf747947ff0bedf87230e0fa08ee534f44f08962a52ae3dd0c0d734d6f4131456a0e2dc1ac230fa6500d5b254a64cae9e01161d1a690e26794c38d66e22cb5ed

  • SSDEEP

    192:IUxOQrGVa/nHU0LgJ2jaVb4+LHdrDXy3pifUJ1hHxrWjd:hIQaVafU0LmqaVb4+xPy5ifU1hRyj

  Score

  10^/10

  stormkittyxwormexecutionpersistenceratstealerthemidatrojan

  • Detect Xworm Payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2