Overview

overview

10

Static

static

10

SOLarVA.exe

windows7-x64

9

SOLarVA.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    SOLarVA.exe

  • Size

    4.7MB

  • Sample

    240814-wd1saszfjr

  • MD5

    ddc63bd70b3637c33136be3ad66ed1e1

  • SHA1

    28e5f36693efdd05fc65cef804d4c865c339e939

  • SHA256

    745f38f0dd92b5c696a25a2772a46296c12d2535283ae8237abb4b6dbd976da4

  • SHA512

    0e1cb64749540593042f0cdd7775ac470e61325300a7de8612a9a868fd407940182fb1163cfb6993f8cd3332fca7dcfd8b039dbab5f7a87c0a5354d4c1aa87d0

  • SSDEEP

    98304:wghHWE2yxi5CwaMu/tGvA7MO9P/NK3+x8oncGGT:w8WEflwFu/tGYgOZ/NoO8C

Score
10/10
redlinediscoveryevasionthemidatrojan

Malware Config

Targets

    • Target

      SOLarVA.exe

    • Size

      4.7MB

    • MD5

      ddc63bd70b3637c33136be3ad66ed1e1

    • SHA1

      28e5f36693efdd05fc65cef804d4c865c339e939

    • SHA256

      745f38f0dd92b5c696a25a2772a46296c12d2535283ae8237abb4b6dbd976da4

    • SHA512

      0e1cb64749540593042f0cdd7775ac470e61325300a7de8612a9a868fd407940182fb1163cfb6993f8cd3332fca7dcfd8b039dbab5f7a87c0a5354d4c1aa87d0

    • SSDEEP

      98304:wghHWE2yxi5CwaMu/tGvA7MO9P/NK3+x8oncGGT:w8WEflwFu/tGYgOZ/NoO8C

    Score
    9/10
    discoveryevasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks