General
-
Target
SolaraB.zip
-
Size
5KB
-
Sample
240723-asyqlaxamd
-
MD5
4ec8143b6dbe27870cf8333711ff5096
-
SHA1
693d467ebec348469011ffef1bd370b113653147
-
SHA256
2510be907ec476e8375ac7b5431536ae9a32bf99fe77ab695a5100852b111b96
-
SHA512
b513d2b9c63d999ccf459cea625bfdc481e44f0f3222996182a0d0d89fdb97ed754b927c7a429e43b96f13d2fc73e2860edca78b162a41101ae97e1a0f4e054e
-
SSDEEP
96:Kb43b11j3vs+ieHBgcCXhzWYQ1NJGQ7S8SnV8xT/KiFlg5YNwMHv5F:Kb4rEKhgcghDY4Q7WV8t/VG1o
Malware Config
Targets
-
-
Target
SolaraB.zip
-
Size
5KB
-
MD5
4ec8143b6dbe27870cf8333711ff5096
-
SHA1
693d467ebec348469011ffef1bd370b113653147
-
SHA256
2510be907ec476e8375ac7b5431536ae9a32bf99fe77ab695a5100852b111b96
-
SHA512
b513d2b9c63d999ccf459cea625bfdc481e44f0f3222996182a0d0d89fdb97ed754b927c7a429e43b96f13d2fc73e2860edca78b162a41101ae97e1a0f4e054e
-
SSDEEP
96:Kb43b11j3vs+ieHBgcCXhzWYQ1NJGQ7S8SnV8xT/KiFlg5YNwMHv5F:Kb4rEKhgcghDY4Q7WV8t/VG1o
Score1/10 -
-
-
Target
SolaraB/Solara/SolaraBootstrapper.exe
-
Size
13KB
-
MD5
6557bd5240397f026e675afb78544a26
-
SHA1
839e683bf68703d373b6eac246f19386bb181713
-
SHA256
a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239
-
SHA512
f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97
-
SSDEEP
192:konexQO0FoAWyEfJkVIaqaLHmr/XKT0ifnTJ1jvVXctNjA:HnexHAWyEfJoIaqayzKAifd1LVEj
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-