Overview
overview
7Static
static
3S$olaBma/P...ce.dll
windows7-x64
1S$olaBma/P...ce.dll
windows10-2004-x64
1S$olaBma/S...61.exe
windows7-x64
7S$olaBma/S...61.exe
windows10-2004-x64
7S$olaBma/U...on.dll
windows7-x64
1S$olaBma/U...on.dll
windows10-2004-x64
1S$olaBma/U...er.dll
windows7-x64
1S$olaBma/U...er.dll
windows10-2004-x64
1S$olaBma/U...er.dll
windows7-x64
1S$olaBma/U...er.dll
windows10-2004-x64
1S$olaBma/U...ce.dll
windows7-x64
1S$olaBma/U...ce.dll
windows10-2004-x64
1S$olaBma/p...ail.js
windows7-x64
3S$olaBma/p...ail.js
windows10-2004-x64
3S$olaBma/p...ail.js
windows7-x64
3S$olaBma/p...ail.js
windows10-2004-x64
3S$olaBma/p...dit.js
windows7-x64
3S$olaBma/p...dit.js
windows10-2004-x64
3S$olaBma/p...new.js
windows7-x64
3S$olaBma/p...new.js
windows10-2004-x64
3S$olaBma/p...mpl.js
windows7-x64
3S$olaBma/p...mpl.js
windows10-2004-x64
3S$olaBma/p...how.js
windows7-x64
3S$olaBma/p...how.js
windows10-2004-x64
3S$olaBma/p...ite.js
windows7-x64
3S$olaBma/p...ite.js
windows10-2004-x64
3S$olaBma/p...ser.js
windows7-x64
3S$olaBma/p...ser.js
windows10-2004-x64
3S$olaBma/p...orm.js
windows7-x64
3S$olaBma/p...orm.js
windows10-2004-x64
3S$olaBma/p...ter.js
windows7-x64
3S$olaBma/p...ter.js
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
S$olaBma/Packaged/Resource.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
S$olaBma/Packaged/Resource.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
S$olaBma/S0dthur3t61.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
S$olaBma/S0dthur3t61.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
S$olaBma/Updates/Addition.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
S$olaBma/Updates/Addition.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
S$olaBma/Updates/Cracker.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
S$olaBma/Updates/Cracker.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
S$olaBma/Updates/Helper.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
S$olaBma/Updates/Helper.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
S$olaBma/Updates/Resource.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
S$olaBma/Updates/Resource.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
S$olaBma/plugins/admin/controller/api_detail.js
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
S$olaBma/plugins/admin/controller/api_detail.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
S$olaBma/plugins/admin/controller/detail.js
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
S$olaBma/plugins/admin/controller/detail.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
S$olaBma/plugins/admin/controller/edit.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
S$olaBma/plugins/admin/controller/edit.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
S$olaBma/plugins/admin/controller/new.js
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
S$olaBma/plugins/admin/controller/new.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
S$olaBma/plugins/admin/controller/plugins_tmpl.js
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
S$olaBma/plugins/admin/controller/plugins_tmpl.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
S$olaBma/plugins/admin/controller/show.js
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
S$olaBma/plugins/admin/controller/show.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
S$olaBma/plugins/admin/models/site.js
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
S$olaBma/plugins/admin/models/site.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
S$olaBma/plugins/admin/models/user.js
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
S$olaBma/plugins/admin/models/user.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
S$olaBma/plugins/admin/modules/form/form.js
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
S$olaBma/plugins/admin/modules/form/form.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
S$olaBma/plugins/admin/modules/parameter/parameter.js
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
S$olaBma/plugins/admin/modules/parameter/parameter.js
Resource
win10v2004-20240508-en
General
-
Target
S0LARDfgjNFjfwu327fwg3huio2S.zip
-
Size
12.6MB
-
MD5
9728bea0cc1fb31ca5e49f1f3e6ac102
-
SHA1
4023d32c683baffa808a3acc69bbae03305770c0
-
SHA256
f7014bce6117b1f01b29c239e3d262b09c9d374851121f8c425e0f16a92cfdbc
-
SHA512
b892a68a063f02bc134cc217a4c77dab70e1b6a0eea85e35a801b071a6a9db236b3b1c61ed4573a2ba55c45837877c7ea53a06432181c540a6a61d0232cc0ec9
-
SSDEEP
196608:mOstXoBqmegmNbq8DSy9YB+B2pX1lKg2PFx2TgMLrQFyR6Xyf/p5v8lr0h:mb4g7HbqmS+YwB2x2N0jRRfBN46
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/S$olaBma/S0dthur3t61.exe
Files
-
S0LARDfgjNFjfwu327fwg3huio2S.zip.zip
Password: 6868
-
S0dthur3t61.zip.zip
Password: 6868
-
S$olaBma/Language.pimx
-
S$olaBma/Main.ini
-
S$olaBma/Packaged/Main.ini.xml
-
S$olaBma/Packaged/Resource.dll
-
S$olaBma/Packaged/Utils.dll.xml
-
S$olaBma/S0dthur3t61.exe.exe windows:4 windows x86 arch:x86
Password: 6868
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
z34_YC Size: 451KB - Virtual size: 451KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
S$olaBma/Updates/Addition.dll
-
S$olaBma/Updates/Autoupdater.ini
-
S$olaBma/Updates/Cracker.dll
-
S$olaBma/Updates/DebugPPF.tmp
-
S$olaBma/Updates/DebugPPT.tmp
-
S$olaBma/Updates/Helper.dll
-
S$olaBma/Updates/Management.log
-
S$olaBma/Updates/Resource.dll
-
S$olaBma/Updates/main.ini
-
S$olaBma/plugins/admin/admin.go
-
S$olaBma/plugins/admin/controller/Update.go
-
S$olaBma/plugins/admin/controller/api_create.go
-
S$olaBma/plugins/admin/controller/api_detail.go.js
-
S$olaBma/plugins/admin/controller/api_list.go
-
S$olaBma/plugins/admin/controller/api_update.go
-
S$olaBma/plugins/admin/controller/auth.go
-
S$olaBma/plugins/admin/controller/common.go
-
S$olaBma/plugins/admin/controller/common_test.go
-
S$olaBma/plugins/admin/controller/delete.go
-
S$olaBma/plugins/admin/controller/detail.go.js
-
S$olaBma/plugins/admin/controller/edit.go.js
-
S$olaBma/plugins/admin/controller/handler.go
-
S$olaBma/plugins/admin/controller/install.go
-
S$olaBma/plugins/admin/controller/menu.go
-
S$olaBma/plugins/admin/controller/new.go.js
-
S$olaBma/plugins/admin/controller/operation.go
-
S$olaBma/plugins/admin/controller/plugins.go
-
S$olaBma/plugins/admin/controller/plugins_tmpl.go.js
-
S$olaBma/plugins/admin/controller/show.go.js
-
S$olaBma/plugins/admin/controller/system.go
-
S$olaBma/plugins/admin/data/mysql/admin.sql
-
S$olaBma/plugins/admin/data/sqlite/admin.db
-
S$olaBma/plugins/admin/models/base.go
-
S$olaBma/plugins/admin/models/menu.go
-
S$olaBma/plugins/admin/models/operation_log.go
-
S$olaBma/plugins/admin/models/permission.go
-
S$olaBma/plugins/admin/models/role.go
-
S$olaBma/plugins/admin/models/site.go.js
-
S$olaBma/plugins/admin/models/user.go.js
-
S$olaBma/plugins/admin/modules/captcha/captcha.go
-
S$olaBma/plugins/admin/modules/constant/constant.go
-
S$olaBma/plugins/admin/modules/form/form.go.js
-
S$olaBma/plugins/admin/modules/guard/delete.go
-
S$olaBma/plugins/admin/modules/guard/edit.go
-
S$olaBma/plugins/admin/modules/guard/export.go
-
S$olaBma/plugins/admin/modules/guard/guard.go
-
S$olaBma/plugins/admin/modules/guard/menu_delete.go
-
S$olaBma/plugins/admin/modules/guard/menu_edit.go
-
S$olaBma/plugins/admin/modules/guard/menu_new.go
-
S$olaBma/plugins/admin/modules/guard/new.go
-
S$olaBma/plugins/admin/modules/guard/server_login.go
-
S$olaBma/plugins/admin/modules/guard/update.go
-
S$olaBma/plugins/admin/modules/helper.go
-
S$olaBma/plugins/admin/modules/helper_test.go
-
S$olaBma/plugins/admin/modules/paginator/paginator.go
-
S$olaBma/plugins/admin/modules/paginator/paginator_test.go
-
S$olaBma/plugins/admin/modules/parameter/parameter.go.js
-
S$olaBma/plugins/admin/modules/parameter/parameter_test.go
-
S$olaBma/plugins/admin/modules/response/response.go.js
-
S$olaBma/plugins/admin/modules/table/config.go
-
S$olaBma/plugins/admin/modules/table/default.go.js
-
S$olaBma/plugins/admin/modules/table/default_test.go
-
S$olaBma/plugins/admin/modules/table/generators.go.js
-
S$olaBma/plugins/admin/modules/table/table.go
-
S$olaBma/plugins/admin/modules/table/tmpl.go.js
-
S$olaBma/plugins/admin/modules/table/tmpl/choose_table_ajax.tmpl.js
-
S$olaBma/plugins/admin/modules/table/tmpl/generator.tmpl.js
-
S$olaBma/plugins/admin/modules/tools/generator.go.js
-
S$olaBma/plugins/admin/modules/tools/template.go
-
S$olaBma/plugins/admin/router.go
-
S$olaBma/plugins/example/controller.go
-
S$olaBma/plugins/example/example.go
-
S$olaBma/plugins/example/go_plugin/Makefile
-
S$olaBma/plugins/example/go_plugin/main.go
-
S$olaBma/plugins/example/router.go
-
S$olaBma/plugins/plugins.go.js
-
S$olaBma/plugins/plugins_test.go
-
S$olaBma/template/chartjs/assets.go
-
S$olaBma/template/chartjs/assets/chart.min.js.js
-
S$olaBma/template/chartjs/assets_list.go.js
-
S$olaBma/template/chartjs/bar.go
-
S$olaBma/template/chartjs/chart.go
-
S$olaBma/template/chartjs/chartjs.tmpl
-
S$olaBma/template/chartjs/line.go
-
S$olaBma/template/chartjs/pie.go
-
S$olaBma/template/chartjs/radar.go
-
S$olaBma/template/chartjs/template.go.js
-
S$olaBma/template/color/color.go
-
S$olaBma/template/components/alert.go
-
S$olaBma/template/components/base.go
-
S$olaBma/template/components/box.go
-
S$olaBma/template/components/button.go
-
S$olaBma/template/components/col.go
-
S$olaBma/template/components/composer.go.js
-
S$olaBma/template/components/form.go
-
S$olaBma/template/components/image.go
-
S$olaBma/template/components/label.go
-
S$olaBma/template/components/link.go
-
S$olaBma/template/components/paninator.go
-
S$olaBma/template/components/popup.go
-
S$olaBma/template/components/product.go
-
S$olaBma/template/components/row.go
-
S$olaBma/template/components/table.go
-
S$olaBma/template/components/tabs.go
-
S$olaBma/template/components/tree.go
-
S$olaBma/template/components/treeview.go
-
S$olaBma/template/icon/icon.go
-
S$olaBma/template/installation/Makefile
-
S$olaBma/template/installation/assets.go
-
S$olaBma/template/installation/assets/installation/dist/all.min.css
-
S$olaBma/template/installation/assets/installation/dist/all.min.js.js
-
S$olaBma/template/installation/assets/installation/dist/respond.min.js.js
-
S$olaBma/template/installation/assets/src/css/font-awesome.min.css
-
S$olaBma/template/installation/assets/src/css/main.css
-
S$olaBma/template/installation/assets/src/css/noscript.css
-
S$olaBma/template/installation/assets/src/fonts/FontAwesome.otf
-
S$olaBma/template/installation/assets/src/fonts/fontawesome-webfont.eot
-
S$olaBma/template/installation/assets/src/fonts/fontawesome-webfont.svg.xml
-
S$olaBma/template/installation/assets/src/fonts/fontawesome-webfont.ttf
-
S$olaBma/template/installation/assets/src/fonts/fontawesome-webfont.woff
-
S$olaBma/template/installation/assets/src/fonts/fontawesome-webfont.woff2
-
S$olaBma/template/installation/assets/src/js/jquery.min.js.js
-
S$olaBma/template/installation/assets/src/js/main.js.js
-
S$olaBma/template/installation/assets/src/js/skel.min.js.js
-
S$olaBma/template/installation/assets_list.go.js
-
S$olaBma/template/installation/installation.go.js
-
S$olaBma/template/installation/installation.tmpl
-
S$olaBma/template/installation/template.go.js
-
S$olaBma/template/login/Makefile
-
S$olaBma/template/login/assets.go
-
S$olaBma/template/login/assets/src/css/0_font.css
-
S$olaBma/template/login/assets/src/css/1_bootstrap.min.css
-
S$olaBma/template/login/assets/src/css/2_animate.css
-
S$olaBma/template/login/assets/src/css/3_style.css
-
S$olaBma/template/login/assets/src/js/combine/1_jquery.min.js.js
-
S$olaBma/template/login/assets/src/js/combine/2_bootstrap.min.js.js
-
S$olaBma/template/login/assets/src/js/combine/3_particles.js.js
-
S$olaBma/template/login/assets/src/js/combine/4_main.js
-
S$olaBma/template/login/assets/src/js/respond.min.js.js
-
S$olaBma/template/login/assets_list.go.js
-
S$olaBma/template/login/login.go.js
-
S$olaBma/template/login/login.tmpl
-
S$olaBma/template/login/template.go
-
S$olaBma/template/template.go.js
-
S$olaBma/template/template_test.go
-
S$olaBma/template/types/action/ajax.go.js
-
S$olaBma/template/types/action/base.go
-
S$olaBma/template/types/action/event.go
-
S$olaBma/template/types/action/fieldfilter.go.js
-
S$olaBma/template/types/action/file_upload.go.js
-
S$olaBma/template/types/action/jump.go
-
S$olaBma/template/types/action/jump_selectbox.go
-
S$olaBma/template/types/action/popup.go.js
-
S$olaBma/template/types/button.go.js
-
S$olaBma/template/types/components.go.js
-
S$olaBma/template/types/display.go.js
-
S$olaBma/template/types/display/base.go
-
S$olaBma/template/types/display/bool.go
-
S$olaBma/template/types/display/carousel.go
-
S$olaBma/template/types/display/copy.go.js
-
S$olaBma/template/types/display/date.go
-
S$olaBma/template/types/display/dot.go
-
S$olaBma/template/types/display/downloadable.go
-
S$olaBma/template/types/display/filesize.go
-
S$olaBma/template/types/display/icon.go
-
S$olaBma/template/types/display/image.go
-
S$olaBma/template/types/display/label.go
-
S$olaBma/template/types/display/link.go
-
S$olaBma/template/types/display/loading.go
-
S$olaBma/template/types/display/progressbar.go
-
S$olaBma/template/types/display/qrcode.go
-
S$olaBma/template/types/display_test.go
-
S$olaBma/template/types/form.go.js
-
S$olaBma/template/types/form/form.go
-
S$olaBma/template/types/form/form_test.go
-
S$olaBma/template/types/form/select/select.go.ps1
-
S$olaBma/template/types/form_test.go
-
S$olaBma/template/types/info.go.js
-
S$olaBma/template/types/info_test.go
-
S$olaBma/template/types/operators.go
-
S$olaBma/template/types/page.go.js
-
S$olaBma/template/types/select.go
-
S$olaBma/template/types/size.go.js
-
S$olaBma/template/types/table/table.go
-
S$olaBma/template/types/tmpl.go.js
-
S$olaBma/template/types/tmpls/choose.tmpl
-
S$olaBma/template/types/tmpls/choose_ajax.tmpl.js
-
S$olaBma/template/types/tmpls/choose_custom.tmpl
-
S$olaBma/template/types/tmpls/choose_disable.tmpl
-
S$olaBma/template/types/tmpls/choose_hide.tmpl.js
-
S$olaBma/template/types/tmpls/choose_map.tmpl
-
S$olaBma/template/types/tmpls/choose_show.tmpl.js
-
readme.txt