Resubmissions

30-08-2024 20:29

240830-y9xrmavdll 10

General

  • Target

    Solara.zip

  • Size

    14.9MB

  • Sample

    240830-y9xrmavdll

  • MD5

    456adec7a01fff85c1204428b5123a66

  • SHA1

    26165fe003a01a3a59dc64070fbf2e96187214d7

  • SHA256

    b6127458de06667662655e158e7d1adc6cf505d08d9dffe243a0b308b3166090

  • SHA512

    3b2cbfaf171297da578c0db840e54a156a1aec481a0f441acaddfe127d20f1013d62a74c99fdbb8a44bc9ced109aa25509dad05131cc5cfe99ade170027fcc41

  • SSDEEP

    393216:+H7gx90ywmq3gvGQ1HUPri1xktbsUjLz0Gh/1LtXsacBvC1x:u7e92v+PRUDi1Qv3T1LtcaEvC1x

Malware Config

Extracted

Family

rhadamanthys

C2

https://144.76.133.166:8034/5502b8a765a7d7349/k5851jfq.guti6

Targets

    • Target

      Solara/Debug/Addition.dll

    • Size

      30KB

    • MD5

      f22e849a370cdf127f48beab596bdd81

    • SHA1

      fb1da47c7a246f2cda7f7686a468efafd9933b1e

    • SHA256

      8be1f5581437b6f5ba48705e8956c8bc0765bbd1d6053242640c75bd94048aa9

    • SHA512

      6ded81fe4d4db69586d74fdb425c4fc8c092508e7e0b49eb141a9045abf40626d14659fa6237a3920e58571ca7acf4911cdf03c4307fd89b6dc5e54172afbc14

    • SSDEEP

      768:Fol18SuOO3bBAughXjNPQsXVjWuu7jqWdTS2gS:er6tAugVjN4sXJYjqWdm2V

    Score
    1/10
    • Target

      Solara/Debug/Helper.dll

    • Size

      189B

    • MD5

      9bb9aba5dd893bbccfa45e2d75d55d26

    • SHA1

      5714796513341ac3159a6a3c23d4769209063d35

    • SHA256

      6b325cadd8992d998c4fbc8ed56079c2850b68ea2d38432d51c26ce82b0a5419

    • SHA512

      f57df9a4a02bd17772acb3ac1a0d961c53f6940600b58834ae38c198a98ae651a21b382450b267aeffbca4ab262668ae471a78ed99bf9dfa414c1316056a289b

    Score
    1/10
    • Target

      Solara/Debug/Resource.dll

    • Size

      10.7MB

    • MD5

      641dadbb3f03938da99bf7c6c4cc482f

    • SHA1

      b21bdb69a17642ade8e62fcbd779ff1bc89ea809

    • SHA256

      883aefb081a1f9ef974ceb16e12c215e92fee13531c052279404bd11b2f8e479

    • SHA512

      7aea5f0db9b261a17801124d6eef0df2d3ada4a6f624c8f4f2ee519a61171a3f06de9032493e3309a1a982fd1218613dde73a942942df2a8ec367e7f66a531f5

    • SSDEEP

      196608:8B4DNtjVoWhIdAXplnpnh4uIKZ2K245peMKU3lRM9RVIO+QvSNG2uM+XGE4:04vWGIun1GKZ/2aZKU3lRvO+QvQgGP

    Score
    1/10
    • Target

      Solara/Packaged/Resource.dll

    • Size

      189B

    • MD5

      4427aeee68321d0f4d7befa74e669f83

    • SHA1

      4670003762a1c217c9e8ea48fcc53f2871a7c341

    • SHA256

      a9661f89b8d957f4e71cbe1ba0342a39e5b50a1d80d974e2e1b349a273967f1b

    • SHA512

      9d9156aa8fdebf19363fed2edb82235642c8c20549369470e44fdc0db41324e2160968fd7dd43eecce1ce3da9c03dd05cdefc8d903a9d0394f5ca9a73f5c5fa3

    Score
    1/10
    • Target

      Solara/Solara.exe

    • Size

      6.2MB

    • MD5

      da26c67d857555aeef4f2580e53d7c6d

    • SHA1

      fc39f8e1987aa7d8553b052b789a7e6b0d24a68a

    • SHA256

      b9536929d0de9b4a18e7646f2ecf59aad20f93092e982be91d20143d599e6c22

    • SHA512

      115ff4890967b3a00bf2e192d9e2d8717bc7525bab995ca5db7c5c7d2be6a81888ae9687f51d04d053371088e553381a7844a82433240022bccbc44b319df75d

    • SSDEEP

      98304:yyjZJD+ddKUmXQ+ZQaJOV20y89y8dfWwl+ZILeXLel:yEZJD+Xe7ZQaIE0jzWwlXebel

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Suspicious use of SetThreadContext

    • Target

      Solara/accessibilitycpl.dll

    • Size

      274KB

    • MD5

      f316026e08074300cbdcd8453bfd3116

    • SHA1

      c7494558e98e42930b83349ea816963147242fba

    • SHA256

      a28ef80b49f85f95f929d5c40245b05f95d58bb672764c3539ce69098db9bcc2

    • SHA512

      cb205111f99cdd4ab930644dfc910f82015175c452be330dcdbee3cff3a07234bf6e77c5967a33fb02ec0bdd993b96b19964160a5511dcfa684a77508aede047

    • SSDEEP

      6144:2f/fsr6htcMmmdxeAXXDoDGNIPTympgJp3P:O/fsr6hCtUxeLymW

    Score
    1/10
    • Target

      Solara/oleprn.dll

    • Size

      148KB

    • MD5

      e0f375597c9bc2d444be3dc6a65f06e9

    • SHA1

      11589152b702675bb211054020e33f2659c34842

    • SHA256

      3e595c971729c2eb7879b6ce468d11e286ea98fa8c1abf93abbc5888542013d0

    • SHA512

      0299035f227cf1285d1f149c5e67805d1f8c78469fd6fefdbc4616b3f555f7f52c8addc0dc004ce9971223a48892ce0ecee316e4d5dd6583a02093b7d8d866c0

    • SSDEEP

      3072:DcSblOUyLB7OCm6U0FRwOyu3tkdwdxyDhkpN0Fc:Dc+8UyLBOmrwOyVOl

    Score
    1/10
    • Target

      Solara/wwancfg.dll

    • Size

      103KB

    • MD5

      997b0b584ffab0b7ff9cbbfc60d60bd2

    • SHA1

      2985c0144da0e9f5dcc0092ac54a5ff99a63f761

    • SHA256

      c4b1f99e87b4568b5b9ff2ded05cebc55376051d44877f5574f2c125566ce604

    • SHA512

      b77553b7a2f5a55ad4dfa49f241961ddce650dd490f0b15b52dfc3c7018e2ba7d28f8387e150177ea3cf12c827afa7a2b7b9eec863199a829a11311bd9607b69

    • SSDEEP

      1536:IGYSem4xUPfgSD0B7+Kcdo5j0XNijwb8Pxsr8jtlelXLZpFtBH0:xYcpPfgSDWa3dJU88pNpUlXVXjH

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks