Overview

overview

10

Static

static

3

Solara Installer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Solara Installer.exe

  • Size

    163KB

  • Sample

    240731-vg8rmstgkk

  • MD5

    108810ab0abf1818950ea0392fcfd9e7

  • SHA1

    8dbe14ee0badaf014465e714b98475262636d2a7

  • SHA256

    22cc3e6bfe946ed84d2b7b3cf7e3a51a3c574fa07cb97240d5cd6685fe5d1825

  • SHA512

    5165572bf6334c724205c5d1c1d0696b2b27018c802a17809a1e03abec926d7deed92aa1e91dea2b3c61c0b64e5317549ffaee26869ca1e9e33a525b5ffb2bf6

  • SSDEEP

    3072:CBMv3nuxy5Spr4FjyHdmlyhAlJuVTHUv8HyJ7hfgGbbp9TRZWZvzX:iCXu45qcFj4I2AlJ6THUv8Hyb4kbDF41

Score
10/10
asyncratdefaultdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

ChuWaWa Rat 5.2

Botnet

Default

C2

31.173.170.243:7777

31.173.170.243:45080

stores-less.gl.at.ply.gg:7777

stores-less.gl.at.ply.gg:45080
Mutex

AtomRatMutex_penka

Attributes
  • delay

    1

  • install

    true

  • install_file

    RuntimeBroker.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Solara Installer.exe

    • Size

      163KB

    • MD5

      108810ab0abf1818950ea0392fcfd9e7

    • SHA1

      8dbe14ee0badaf014465e714b98475262636d2a7

    • SHA256

      22cc3e6bfe946ed84d2b7b3cf7e3a51a3c574fa07cb97240d5cd6685fe5d1825

    • SHA512

      5165572bf6334c724205c5d1c1d0696b2b27018c802a17809a1e03abec926d7deed92aa1e91dea2b3c61c0b64e5317549ffaee26869ca1e9e33a525b5ffb2bf6

    • SSDEEP

      3072:CBMv3nuxy5Spr4FjyHdmlyhAlJuVTHUv8HyJ7hfgGbbp9TRZWZvzX:iCXu45qcFj4I2AlJ6THUv8Hyb4kbDF41

    Score
    10/10
    asyncratdefaultdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks