Extracted

• • Target

    Solara.exe

  • Size

    707KB

  • MD5

    890aefe0eb8cac48c07f1b8c32b40c52

  • SHA1

    354100304c1eedfea760b85804f79995cd558e39

  • SHA256

    9fb5c80c2a1e3d90dfd12b92fe46d1971c19c25f4e9094b6a911636b53c06281

  • SHA512

    d4831595f132738558cfc9d2e11e51c7eb68e4ae3b6ce0d81dee506ca5e856f4970cdbd9a15fc9ac0ecb74ed63b1752c2f576a130e1ec1fcdfeeb11330d580c5

  • SSDEEP

    12288:fCQjgAtAHM+vetZxF5EWry8AJGy0yR1Bjy1hbpyPeVo0Wx1Lk:f5ZWs+OZVEWry8AFfrjy1hVyPeVolrLk

  Score

  10^/10

  umbralevasionstealerthemidatrojan

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2