General

  • Target
    Solara.zip
  • Size 11.4MB
  • Sample240829-wras2atgra
  • SHA256 1584752709b6b0c5cd83ed8d075a29915abadd32ffdd7c8974f45bb45e7aac40
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • rhadamanthys

C2
  • https://144.76.133.166:8034/5502b8a765a7d7349/k5851jfq.guti6

Targets

    • Target
      Solara/Debug/Addition.dll
    • Size 30KB
    • SHA256 8be1f5581437b6f5ba48705e8956c8bc0765bbd1d6053242640c75bd94048aa9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Solara/Debug/Helper.dll
    • Size 189B
    • SHA256 6b325cadd8992d998c4fbc8ed56079c2850b68ea2d38432d51c26ce82b0a5419
    • MD5 SHA1 SHA512
    Score
    1/10
    • Target
      Solara/Debug/Resource.dll
    • Size 10.7MB
    • SHA256 883aefb081a1f9ef974ceb16e12c215e92fee13531c052279404bd11b2f8e479
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Solara/Packaged/Resource.dll
    • Size 189B
    • SHA256 a9661f89b8d957f4e71cbe1ba0342a39e5b50a1d80d974e2e1b349a273967f1b
    • MD5 SHA1 SHA512
    Score
    1/10
    • Target
      Solara/Solara.exe
    • Size 433KB
    • SHA256 cb6b38f445f334599088702569ed9c9d4b0a54c7c88097a16ec6e58055517a3c
    • MD5 SHA1 SHA512 SSDEEP
    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Suspicious use of SetThreadContext

    • Target
      Solara/accessibilitycpl.dll
    • Size 274KB
    • SHA256 a28ef80b49f85f95f929d5c40245b05f95d58bb672764c3539ce69098db9bcc2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Solara/oleprn.dll
    • Size 148KB
    • SHA256 3e595c971729c2eb7879b6ce468d11e286ea98fa8c1abf93abbc5888542013d0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Solara/wwancfg.dll
    • Size 103KB
    • SHA256 c4b1f99e87b4568b5b9ff2ded05cebc55376051d44877f5574f2c125566ce604
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks