Extracted

• • Target

    Solaro.exe

  • Size

    513KB

  • MD5

    b9a7b8d97ac9e492b592e723c47f3f71

  • SHA1

    840d72ade351c907ef21ffc9c87f948016219286

  • SHA256

    80a2a856062d5fdfc9a8d3f68fe717e5128f87ea9fe286e545f45886e1c4ab17

  • SHA512

    4c1cc3b0ef59a4689d2b70778360737c9fc86b4ed0395f303cf4a9a3ae27a1aee8b1140907953c12ba58ffac7709d9e895578a64dd0547f5d14c4cd5d29ae1e9

  • SSDEEP

    12288:cSgkiATxhl6E41yG5uuo0kD4qiGLJROQZZMQPX:3gkiAUhRYuw4HG9XZ+

  Score

  10^/10

  umbralstealerexecutionspyware

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2