General
-
Target
ezWwTYmb9tEG.zip
-
Size
8.8MB
-
Sample
240808-e7nldszbpm
-
MD5
a07a0491c7a6dc150e66f854d2873a9e
-
SHA1
e13ac68db20f21c9961ba65c71bf2351bbf74cf8
-
SHA256
6311747767115ab3ab6fee4fcd7d679d8d4902df00a49697ac089154de003cce
-
SHA512
2da36a033fa00bb9c716bdf973d5471cb47ce4ee9d715f154d573139574a2384edee9e7e62b08c5a820110f278ffd073ed3d84b6f3d8dc0fa2a69feadbfd340b
-
SSDEEP
196608:jDPbPY6IV7lmSiP7+wXHggRmKhaUIfm4W/Xk+Ga:jvqZTiPfXHgMif3+Ga
Malware Config
Targets
-
-
Target
ezWwTYmb9tEG.zip
-
Size
8.8MB
-
MD5
a07a0491c7a6dc150e66f854d2873a9e
-
SHA1
e13ac68db20f21c9961ba65c71bf2351bbf74cf8
-
SHA256
6311747767115ab3ab6fee4fcd7d679d8d4902df00a49697ac089154de003cce
-
SHA512
2da36a033fa00bb9c716bdf973d5471cb47ce4ee9d715f154d573139574a2384edee9e7e62b08c5a820110f278ffd073ed3d84b6f3d8dc0fa2a69feadbfd340b
-
SSDEEP
196608:jDPbPY6IV7lmSiP7+wXHggRmKhaUIfm4W/Xk+Ga:jvqZTiPfXHgMif3+Ga
Score4/10 -
-
-
Target
ReadMe.txt
-
Size
16B
-
MD5
010750e7a1af8ad9e3b438a254d38e1f
-
SHA1
68633b1a8d128ccf001cca7924522beb18c5ee55
-
SHA256
39a69ed81c22a387c09466138716125995f9e7b1ce234b5931f45845fcfde59e
-
SHA512
f36c9fdada7547903e318149485fc143bcc740c8201333ce65ac4c1fbad000b4da65e2efa9bc3d1ec319b911204c40a8dd4efcfbc5ab156d4901a8d5fc6d1a89
Score3/10 -
-
-
Target
So1ara.rar
-
Size
8.8MB
-
MD5
8dbbcf02455e12221dea914a62f4469d
-
SHA1
0cb3692ef4316a24b0e40a145fb1a8e9572c57cc
-
SHA256
477a1fd64afd2e10cc1b58f1165eca89d11857e662573fc43e7ff82d003f3354
-
SHA512
a68c9dc782f4fedf56b58de560168156cbd405079da732a63cc5531bd3516adf0fc9bf70ba5e2a093895d74dcc79e3b6a38f69324548f2a08de6fb1137404e63
-
SSDEEP
196608:iDPbPY6IV7lmSiP7+wXHggRmKhaUIfm4W/Xk+GA:ivqZTiPfXHgMif3+GA
Score3/10 -
-
-
Target
Solara/Solar/SolaraBootstrapper.exe
-
Size
149.8MB
-
MD5
514a5006c26dffcd6d6a7ec4ca897ed6
-
SHA1
12514a2dadfef13a209697d2af2cda955e1d9468
-
SHA256
e7a36dd328ba20e8695a1d07a25a71edb41f649ee118d9f1c27139fd59fcb35c
-
SHA512
21ffb034e8cf1913c62ec647f4872aa51e93db0ec45ad03ac559577c7265ee2a0a54e569ab87ebfc4f23b538a2b65df50c98ee75a7a773afce6c82591c778ab7
-
SSDEEP
1572864:RTBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBn:
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates processes with tasklist
-
-
-
Target
$TEMP/Bolt
-
Size
70KB
-
MD5
7ff18f550ee982d1c609f0ac54c59b1c
-
SHA1
115af2ad5292ca76b85ff4e02263bc7829a64b43
-
SHA256
60049115790147848413a5b6b5046d2dc7ae038b319bed53749cdbc1fdc23cfc
-
SHA512
3c00755e5fa75475fec62d19a3cd58ea36294eed6c5cd682ba794819c1cae6eeb3f96aa7e63a382564bb2231af0293afe00064874dca57c3f5423f06dc106234
-
SSDEEP
1536:Y9n+JW9nWkOEeO9NAUlRzNASe8o+vJairZAzm0IthG5xv:Y9+s9dOxGNAUzmI5yz9Ithkxv
Score1/10 -
-
-
Target
$TEMP/Consistent
-
Size
76KB
-
MD5
66bbd8d50edfa12e57b0af52bc7f456b
-
SHA1
6c414e8ba8ef8e179eb96a894a75e10c2a943015
-
SHA256
c02e044b9da1e4edecc37c83c06abe69d6d1178a669fca3f4c78b514b0345f70
-
SHA512
b4b0c91ec423355481b35ad411f4501b13fc604ed11d7d77960c72de2a7799530053a146b45ef910f7db92e3477831044983cb58990ce0f40dceac53ede39ac2
-
SSDEEP
1536:B6GW/MUkMOfirfgXNOUWzs92ANcJXGikpRrG+ZmGtJY9Qd8f9tN2qRa0K:6MKO4f8NOUnNsrkpgomYitQAlK
Score1/10 -
-
-
Target
$TEMP/Dr
-
Size
54KB
-
MD5
b2ed5751e918601dda9729e8a41f61de
-
SHA1
b39da18af098fcaae3b4eae5a288054d2d926fe8
-
SHA256
15e62fb9ba7fcc3100f3232e9d9122d16c41b82be1b5b659662371bc30ee4190
-
SHA512
698091e2db997a132d093d25e323cf8d0c817827cb46767e9559944aff1e4cc09600734e03eb407d93a257708c440f6d07c09215194473100a68ee9f89de9a74
-
SSDEEP
768:BdrDjppU0slmRaY8TpvPix7Ln5kLAyOD67MQtRZjBH+Dx65LRvr7aAVio5e7w5ak:BhhirK7VkpC6Zfu9C/yo5e7Vq6UvF
Score1/10 -
-
-
Target
$TEMP/Fleet
-
Size
60KB
-
MD5
ac1f3b21cd1c110fc58d986e4f6f8d8b
-
SHA1
e6e524b79cf4301876e6b6f4a0b4339dad666ac2
-
SHA256
2553e041e8540db4da38df68258e72b7c9d1bd01d3ba8df82fdf94bdea6f1e57
-
SHA512
ef48d88d836f69f372466bfcd9c20ec68dcef4f3a840c0e7fbe0e40af935b652f37da415725b2a295ff96f72f73ffbe2b1961f1ceeeb7971041a021203435071
-
SSDEEP
1536:KES6IDp3aoMm8llSdiG0g60Fmb4ZMFSisodc0+UTUJ:FSz93almAlSUGb60FGSibc09UJ
Score1/10 -
-
-
Target
$TEMP/Inexpensive
-
Size
97KB
-
MD5
a0ea14cdf9d5f5f999fa22e5f14ca09b
-
SHA1
9b67c5ea6680fb93cbda3fbe332c54a4272e52ee
-
SHA256
202875f02bd7d4cedf6457ec61db4bf9c32a8ced3cbec4636af8e95163a6b0cc
-
SHA512
2bd7c9a06ef23f58849c1e2411fce49052c1f59e28af41ad127bc9134430699a73841b8b80f4024d49cea28a17de813790e9c642642651aea680d2f824fdd633
-
SSDEEP
1536:Vgdsey7jzySKEwXL6ibtRmto+9G2VxBnGq0mtdQQNXM9B4a9t7A7jWJxXvaF4w:WqjOXL6iPQl7R0m/qGCFGjmEF4w
Score1/10 -
-
-
Target
$TEMP/Park
-
Size
55KB
-
MD5
9a2f7a1099d5c6b8023442986b7d3f63
-
SHA1
553623dd6c4f4afcf6e4a201c708d6bd23463600
-
SHA256
09bfb2fc7ea7858f6041a2397f8163bdbdbdc38a8e985467cbff5f845cfb9cfc
-
SHA512
c5b904906219c920046bdff253c0ec0287dbbcb120915d9d169b312cbcace6bdc1962e4e29dc9242e16e6c59669fac73b02ef63b301d50e5ab44d92ca457c56f
-
SSDEEP
768:UkFKfAOQiLjfLwucbvDjJVse4ybnQ2BOUiZkqem4uv/v7dTwx6rEqmRbGMnxWGkD:UxbQivfLwxnp4wIZkqh/RAwE3RyMTkD
Score1/10 -
-
-
Target
$TEMP/Telescope
-
Size
89KB
-
MD5
456f4d56c8f909ffcf0ff0a91d8fc1c0
-
SHA1
2f68d54fb1d7f0c61a6f57ea13fe59ee8870e576
-
SHA256
4d377450f006468929f4a2c5d9a174816ca42454d2b26f44dc319a80e85a37d3
-
SHA512
c91fcedfce69080f43e124cc94bcd503b41faeb340ef66cf238bd49d2e145907da4e3f419156e472952135957cd760c924bb0d0f9d995aab55ec387015c11710
-
SSDEEP
1536:+Yn7D9H+g5pEjFdPTJm9yks+B7FeNuPKA/+jZl0zCCRF22Rw8O5KCxL6RGgvRPY:dx+62I9KNux/CZl0z522RwbJx2wyNY
Score1/10 -
-
-
Target
$TEMP/Viruses
-
Size
872KB
-
MD5
8ed2e8863c6355ae9a64c291b8af7bec
-
SHA1
aafc6cb30c6f5f0f0f10c8e9f10107b3614c7d1a
-
SHA256
0019a1fe0412a33f7d8bc05dd100794ec3bea0680d2b27d330f8ffb2805bbadb
-
SHA512
1c14dfed9d37e6dd38d5ac3c1e0ca0dba959cfb753681808e1bc98d2c98840ad50dade87e2ae84c0ad1f6aadc417dee3ef11dfa37b864d8588dec1483b297fca
-
SSDEEP
12288:xpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:xT3E53Myyzl0hMf1tr7Caw8M01
Score1/10 -
-
-
Target
$TEMP/Wellington
-
Size
75KB
-
MD5
b93b6fe702a14c19fb76ec5decde645c
-
SHA1
3e661059f7c9dbddcc7d8b787e11b12e44c78492
-
SHA256
ed3554d9146977b097a160d1ead6970b958846aab4c2eb693b6a2a47ee1f3796
-
SHA512
440d8d93db6e8c5e461ad5ebe423a511d911efb135cca33b61cb1729ba4cb07d22c7d609227097c20bc32040d7f69cde716a1fcd8149973de39711678102587b
-
SSDEEP
1536:Hzy8aFp10/imDnUiz/gah4JsL4v3SGBCzCxofywZx16TAs+s39jc2oG:TXLlz/gcIFKGgCOdpE3Fc27
Score1/10 -
-
-
Target
SaturnSexo/Animal
-
Size
692B
-
MD5
31c1e59569e694098305c7b2d5c8401e
-
SHA1
762ce052bc83f6f917cb5afe5d354bb279d2b3f8
-
SHA256
2e439a7e4674589c3e4da070ef4dfe392abf65dac006911ba3aeb54673580abd
-
SHA512
1604e8b8fe8ada65bcd468d1b6017e70834db5b3dc36ae4d052079a049c58085a072e11115ac66463cb4e6b0f3c87bdccb8b78f460eb6e7d39c7787c1da7e7e7
Score1/10 -
-
-
Target
SaturnSexo/Graphic
-
Size
71KB
-
MD5
9f5e004cc57210c7d4812afd5b37b738
-
SHA1
8ae7a822e30aebcc0e7dbff3abdbcc68d83bc883
-
SHA256
9a0dbaad05c54a38059217ea7e14952d669d45dac6ccf6baa37be09c70bb728e
-
SHA512
a36224c168d8b87ea3c5b4e3dde613fe51ab831215388f1221ef0c4392af003bab4bf2ab250381b2f211bad6eb4432ac694bad9e23585cf5e767d130f44bf73e
-
SSDEEP
1536:Mh4C4j5G7SjLvdk5ILHezz8dCmsbc1AfnHolGwHxiz:MyVNjzgIrezz8xAfUGwHxiz
Score1/10 -
-
-
Target
SaturnSexo/Proven
-
Size
38KB
-
MD5
4e3f4efa93dbdf98812171adf2c2152c
-
SHA1
7d661a6c55a1bfc202946297a1e2e79895d65498
-
SHA256
8cedffe95d1aa7a6921ecdb2fa837285bc4c692f07df8a00c37083c8c8fc0bba
-
SHA512
2d47e96f82348a6f779ddc59783c08f5e0f11c2d318d5da52bb4f11b694399ec6e5276f09d6bbce8973bfb230e7b042c57957f89b6b448e9a2a6d5cd9d0bb1e6
-
SSDEEP
768:C+/jO56wA+R/B0XR0ZXbU2hqn7TT/yBYh6PTWHhYkraTEMfe0ULsIhA:BOof7h6X9KIYh6iHOk+wk1ULsIhA
Score1/10 -
-
-
Target
SaturnSexo/Representations
-
Size
29KB
-
MD5
df007300e1a7a92b49244a15ad6bd975
-
SHA1
8493cca1b5f6fe9e85b9daef895e563d30068bb6
-
SHA256
20ea6fa491b528191f772e4814a7ebc3a665b526b6149f187d9b71cb9ef72b00
-
SHA512
298e5d02469a362cf47957918a3bd1a2e9c9e016cf2a47df584d54b8a4e53ec2e4f87254237fc552531444d595a059b5637d87d83f8a79202e4fc321fb9b1943
-
SSDEEP
768:LX/TokTWi1k9/FuD+ylqTUgtyu1ehk2NRu2N6QcN3LAZ5A22I:rZb1W/IDHit51etMQoLWXZ
Score1/10 -
-
-
Target
Solara/Solar/autoexec/test.lua
-
Size
34B
-
MD5
f051c998ef025a1ccd4f6f7abe16e55e
-
SHA1
2e75e1237531ae3c0647c0fad7cf6ae1687d0e99
-
SHA256
601c187ff3410f7c71258bd29c0e48a9f40a046a745093f71e7172decf0f0eae
-
SHA512
748cb431b3a2208c07187c80a3c5b5174b2c536fb056e7b48646875cbd4392225da4aaaaf376f16ca79ab854245e7638cf02103f0913abff55e005da482d498a
Score3/10 -
-
-
Target
Solara/Solar/autoexec/test2.lua
-
Size
11B
-
MD5
701bf4a4743e5e0361e26999881a5ce9
-
SHA1
f34d33bcb5c13eae1c15faddc6054e479f74aa28
-
SHA256
c2d0a5e0790d97a015387a995c0d0b5eb3e88138466586fc980787c9b1731eb8
-
SHA512
8c0eedc5dca108eb9682239164cba3c70ba4c12e4520a9bdfa8efce0416ce51534fcea2ef4dcd7ea2dfc684358a064233165b0bda5287892de2014a1f2b21c6f
Score3/10 -
-
-
Target
Solara/Solar/bin/api
-
Size
18.7MB
-
MD5
88fd7dbf04bcf75123d02009aea3f7f7
-
SHA1
cecf16bdad71e54afc941179ea2b7438a04efa1d
-
SHA256
01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4
-
SHA512
2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917
-
SSDEEP
393216:hqA/D2IIyzg8DolBo6i0KoI6Di42sC1/syU3DXNs6hq8:hqcaZyV0fC1JOpjhq8
Score3/10 -
-
-
Target
Solara/Solar/workspace/.tests/appendfile.txt
-
Size
7B
-
MD5
260ca9dd8a4577fc00b7bd5810298076
-
SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6
-
SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
-
SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
Score3/10 -
-
-
Target
Solara/Solar/workspace/.tests/getcustomasset.txt
-
Size
7B
-
MD5
260ca9dd8a4577fc00b7bd5810298076
-
SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6
-
SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
-
SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
Score3/10 -
-
-
Target
Solara/Solar/workspace/.tests/isfile.txt
-
Size
7B
-
MD5
260ca9dd8a4577fc00b7bd5810298076
-
SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6
-
SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
-
SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
Score3/10 -
-
-
Target
Solara/Solar/workspace/.tests/listfiles/test_1.txt
-
Size
7B
-
MD5
260ca9dd8a4577fc00b7bd5810298076
-
SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6
-
SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
-
SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
Score3/10 -
-
-
Target
Solara/Solar/workspace/.tests/listfiles/test_2.txt
-
Size
7B
-
MD5
260ca9dd8a4577fc00b7bd5810298076
-
SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6
-
SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
-
SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
Score3/10 -
-
-
Target
Solara/Solar/workspace/.tests/loadfile.txt
-
Size
1B
-
MD5
8fa14cdd754f91cc6554c9e71929cce7
-
SHA1
4a0a19218e082a343a1b17e5333409af9d98f0f5
-
SHA256
252f10c83610ebca1a059c0bae8255eba2f95be4d1d7bcfa89d7248a82d9f111
-
SHA512
711c22448e721e5491d8245b49425aa861f1fc4a15287f0735e203799b65cffec50b5abd0fddd91cd643aeb3b530d48f05e258e7e230a94ed5025c1387bb4e1b
Score3/10 -
-
-
Target
Solara/Solar/workspace/.tests/readfile.txt
-
Size
7B
-
MD5
260ca9dd8a4577fc00b7bd5810298076
-
SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6
-
SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
-
SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
Score3/10 -
-
-
Target
Solara/Solar/workspace/.tests/writefile
-
Size
7B
-
MD5
260ca9dd8a4577fc00b7bd5810298076
-
SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6
-
SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
-
SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
Score1/10 -
-
-
Target
Solara/Solar/workspace/.tests/writefile.txt
-
Size
7B
-
MD5
260ca9dd8a4577fc00b7bd5810298076
-
SHA1
53a5687cb26dc41f2ab4033e97e13adefd3740d6
-
SHA256
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
-
SHA512
51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
Score3/10 -
-
-
Target
Solara/Solar/workspace/EzHubLL.txt
-
Size
2B
-
MD5
99914b932bd37a50b983c5e7c90ae93b
-
SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
-
SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
-
SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
Score3/10 -
-
-
Target
Solara/Solar/workspace/IY_FE.iy
-
Size
539B
-
MD5
291d5636a434c4f1ceb0f3f776c2a51f
-
SHA1
ae287e08f71c522a72812f0dace94b8ffb569341
-
SHA256
73bb58ba5b81960caf5a8e66675cc89b5761b77db99c6ceb9435f7211d400452
-
SHA512
7dab8034f85aef1b2b7a86cc8220ebdbb95a3f083d1565e1cff38414367aa69fc597a11aaba11dbef411e13fbfb285855d9c46ae59738f6e88c22dd55c81a743
Score3/10 -
-
-
Target
Solara/Solar/workspace/Sky Hub/Sky Hub Settings.json
-
Size
52B
-
MD5
9a42aefba1beca2d4816e37142fa22db
-
SHA1
387384c567a5bd1ca99568c43315ea39bdaec1e0
-
SHA256
37dd2675939dcf754c08d0a3776908fc7c996849839dcba037848a943f33240b
-
SHA512
77ed2aeab7c10507e74c8001cbafe883d4a308cc3686d0edcf8925db54f00e45337b9ebd7d19c83129cebda0e0eaa9d01a0f5474d0639b6cab5659cfedb80a9b
Score3/10 -
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2