Overview

overview

10

Static

static

10

SolaraBoot...er.exe

windows7-x64

7

SolaraBoot...er.exe

windows10-2004-x64

9

Resubmissions

05/08/2024, 20:11

240805-yyhtbs1blb 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SolaraBootstrapper.exe

  • Size

    30.0MB

  • Sample

    240805-yyhtbs1blb

  • MD5

    8def6d80db11ec36bdf5f86f6de3316b

  • SHA1

    399fd854999b014a26818e09ba2a0f5a6ce9ff58

  • SHA256

    35662500e31d085d460b306293ac426efa47b97dae45f3778906076913944e31

  • SHA512

    6242f2854f9791af8c24c07f86a7f5816c781e1928e19759fda4e01d67a044b197e3f3215a957ca45a6561f7453cfa256a07f0bcb59534febd5afedc3e8a3230

  • SSDEEP

    786432:Y9Z9OAQD7vD+szcY87WGhySW8MCNrZpC3dC:6vhQD7v/E7WGhySWINrZpq

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      SolaraBootstrapper.exe

    • Size

      30.0MB

    • MD5

      8def6d80db11ec36bdf5f86f6de3316b

    • SHA1

      399fd854999b014a26818e09ba2a0f5a6ce9ff58

    • SHA256

      35662500e31d085d460b306293ac426efa47b97dae45f3778906076913944e31

    • SHA512

      6242f2854f9791af8c24c07f86a7f5816c781e1928e19759fda4e01d67a044b197e3f3215a957ca45a6561f7453cfa256a07f0bcb59534febd5afedc3e8a3230

    • SSDEEP

      786432:Y9Z9OAQD7vD+szcY87WGhySW8MCNrZpC3dC:6vhQD7v/E7WGhySWINrZpq

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks