13bb505e4a33c27ee0bb7f84db543303a3646361a5000d5a3cb88bbb4dd2fc87

Sharing

Copy URL Twitter E-mail

General

Target
ًUpdBootstrappً.zip
Size 115.6MB
Sample240902-w7278avemn
SHA256 13bb505e4a33c27ee0bb7f84db543303a3646361a5000d5a3cb88bbb4dd2fc87
MD5 0d116010ec0f436d500cbfaaba73b70d
SHA1 c1cc2849fa32f9060dbc1773925ee4de448cb64d
SHA512 dbecd22a0e108ee83752540ac0856ada21d2d17300486e89874deb60af23f98f14961e8246ddd11e86bedea537974eaef94a0578a8059264c9941abfa4166d4b
SSDEEP 3145728:xGkqmPtcmTbV9jNPb+OvGkqmPtcmTbV9jNPb+O3:xGRoc43PPGRoc43PX
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  ًUpdBootstrappً.zip
- Size 115.6MB
- SHA256 13bb505e4a33c27ee0bb7f84db543303a3646361a5000d5a3cb88bbb4dd2fc87
- MD5 0d116010ec0f436d500cbfaaba73b70d
- SHA1 c1cc2849fa32f9060dbc1773925ee4de448cb64d
- SHA512 dbecd22a0e108ee83752540ac0856ada21d2d17300486e89874deb60af23f98f14961e8246ddd11e86bedea537974eaef94a0578a8059264c9941abfa4166d4b
- SSDEEP 3145728:xGkqmPtcmTbV9jNPb+OvGkqmPtcmTbV9jNPb+O3:xGRoc43PPGRoc43PX
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

defense_evasion discovery
- Downloads MZ/PE file
- Drops file in System32 directory
behavioral1
- Target
  Solaraً.zip
- Size 57.8MB
- SHA256 0bfecd7eee36c4d43a39afbc6e695c6bf1c6a16d3c975ad296c86676245a04a2
- MD5 34779296672678a1c756d9fe33306a5e
- SHA1 0b312c1f05d1b6248ae1eab4309eb935ac2237b3
- SHA512 e7e0eade3f368a40a1f67c2305888c5d3e4a24064be5b4dfcecc29c74b1bff8300d1f4e6e5afc666f5d2b95b5b0485a87557ef95e77c545f10398d487695d6bb
- SSDEEP 1572864:XGkAFmeSxXJOGTk9ZF8dTbYyvOOJdzXvN4EgGbriTOD:XGkqmPtcmTbV9jNPb+OD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  Solaraً/Bootstrapperً.exe
- Size 693KB
- SHA256 6b26490431d849d714accf4cf704dc609c845d5c39e6b08ec10f7020635ccd4d
- MD5 ac10e1cb266e694f78ff4a815c06f29a
- SHA1 b0960667b451e09334e84418f90af99b57a5bd16
- SHA512 95472caf45ae38c89e005643e2b994e0da270b5f9e431fbe8dc9cd61d6ff32ccab265d6984414ea5942ed87dea95dc664ed63e5e3541279e590d1377bd119190
- SSDEEP 12288:oT5vOF1f2GHUfW0WtG4XCCsL8W1kmI9Cy6GWZMtgQa0IeiF6h4rXfrVaBQNSKd8f:oT5vOX2Gt0gG49soEIMG
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

credential_access discovery spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Loads dropped DLL
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral3
- Target
  Solaraً/bin/api
- Size 18.7MB
- SHA256 01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4
- MD5 88fd7dbf04bcf75123d02009aea3f7f7
- SHA1 cecf16bdad71e54afc941179ea2b7438a04efa1d
- SHA512 2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917
- SSDEEP 393216:hqA/D2IIyzg8DolBo6i0KoI6Di42sC1/syU3DXNs6hq8:hqcaZyV0fC1JOpjhq8
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral4
- Target
  Solaraً/workspace/.tests/appendfile.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral5
- Target
  Solaraً/workspace/.tests/getcustomasset.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral6
- Target
  Solaraً/workspace/.tests/isfile.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral7
- Target
  Solaraً/workspace/.tests/listfiles/test_1.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral8
- Target
  Solaraً/workspace/.tests/listfiles/test_2.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral9
- Target
  Solaraً/workspace/.tests/loadfile.txt
- Size 1B
- SHA256 252f10c83610ebca1a059c0bae8255eba2f95be4d1d7bcfa89d7248a82d9f111
- MD5 8fa14cdd754f91cc6554c9e71929cce7
- SHA1 4a0a19218e082a343a1b17e5333409af9d98f0f5
- SHA512 711c22448e721e5491d8245b49425aa861f1fc4a15287f0735e203799b65cffec50b5abd0fddd91cd643aeb3b530d48f05e258e7e230a94ed5025c1387bb4e1b
- MD5 SHA1 SHA512
Score

3^/10
behavioral10
- Target
  Solaraً/workspace/.tests/readfile.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral11
- Target
  Solaraً/workspace/.tests/writefile
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

1^/10
behavioral12
- Target
  Solaraً/workspace/.tests/writefile.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral13
- Target
  Solaraً/workspace/EzHubLL.txt
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
Score

3^/10
behavioral14
- Target
  Solaraً/workspace/IY_FE.iy
- Size 539B
- SHA256 73bb58ba5b81960caf5a8e66675cc89b5761b77db99c6ceb9435f7211d400452
- MD5 291d5636a434c4f1ceb0f3f776c2a51f
- SHA1 ae287e08f71c522a72812f0dace94b8ffb569341
- SHA512 7dab8034f85aef1b2b7a86cc8220ebdbb95a3f083d1565e1cff38414367aa69fc597a11aaba11dbef411e13fbfb285855d9c46ae59738f6e88c22dd55c81a743
- MD5 SHA1 SHA512
Score

3^/10
behavioral15
- Target
  Solaraً/workspace/Sky Hub/Sky Hub Settings.json
- Size 52B
- SHA256 37dd2675939dcf754c08d0a3776908fc7c996849839dcba037848a943f33240b
- MD5 9a42aefba1beca2d4816e37142fa22db
- SHA1 387384c567a5bd1ca99568c43315ea39bdaec1e0
- SHA512 77ed2aeab7c10507e74c8001cbafe883d4a308cc3686d0edcf8925db54f00e45337b9ebd7d19c83129cebda0e0eaa9d01a0f5474d0639b6cab5659cfedb80a9b
- MD5 SHA1 SHA512
Score

3^/10
behavioral16
- Target
  Solaraً/Bootstrapperً.exe
- Size 693KB
- SHA256 6b26490431d849d714accf4cf704dc609c845d5c39e6b08ec10f7020635ccd4d
- MD5 ac10e1cb266e694f78ff4a815c06f29a
- SHA1 b0960667b451e09334e84418f90af99b57a5bd16
- SHA512 95472caf45ae38c89e005643e2b994e0da270b5f9e431fbe8dc9cd61d6ff32ccab265d6984414ea5942ed87dea95dc664ed63e5e3541279e590d1377bd119190
- SSDEEP 12288:oT5vOF1f2GHUfW0WtG4XCCsL8W1kmI9Cy6GWZMtgQa0IeiF6h4rXfrVaBQNSKd8f:oT5vOX2Gt0gG49soEIMG
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

credential_access discovery spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Loads dropped DLL
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral17
- Target
  Solaraً/autoexec/test.lua
- Size 34B
- SHA256 601c187ff3410f7c71258bd29c0e48a9f40a046a745093f71e7172decf0f0eae
- MD5 f051c998ef025a1ccd4f6f7abe16e55e
- SHA1 2e75e1237531ae3c0647c0fad7cf6ae1687d0e99
- SHA512 748cb431b3a2208c07187c80a3c5b5174b2c536fb056e7b48646875cbd4392225da4aaaaf376f16ca79ab854245e7638cf02103f0913abff55e005da482d498a
- MD5 SHA1 SHA512
Score

3^/10
behavioral18
- Target
  Solaraً/autoexec/test2.lua
- Size 11B
- SHA256 c2d0a5e0790d97a015387a995c0d0b5eb3e88138466586fc980787c9b1731eb8
- MD5 701bf4a4743e5e0361e26999881a5ce9
- SHA1 f34d33bcb5c13eae1c15faddc6054e479f74aa28
- SHA512 8c0eedc5dca108eb9682239164cba3c70ba4c12e4520a9bdfa8efce0416ce51534fcea2ef4dcd7ea2dfc684358a064233165b0bda5287892de2014a1f2b21c6f
- MD5 SHA1 SHA512
Score

3^/10
behavioral19
- Target
  Solaraً/bin/api
- Size 18.7MB
- SHA256 01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4
- MD5 88fd7dbf04bcf75123d02009aea3f7f7
- SHA1 cecf16bdad71e54afc941179ea2b7438a04efa1d
- SHA512 2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917
- SSDEEP 393216:hqA/D2IIyzg8DolBo6i0KoI6Di42sC1/syU3DXNs6hq8:hqcaZyV0fC1JOpjhq8
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral20
- Target
  Solaraً/workspace/.tests/appendfile.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral21
- Target
  Solaraً/workspace/.tests/getcustomasset.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral22
- Target
  Solaraً/workspace/.tests/isfile.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral23
- Target
  Solaraً/workspace/.tests/listfiles/test_1.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral24
- Target
  Solaraً/workspace/.tests/listfiles/test_2.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral25
- Target
  Solaraً/workspace/.tests/loadfile.txt
- Size 1B
- SHA256 252f10c83610ebca1a059c0bae8255eba2f95be4d1d7bcfa89d7248a82d9f111
- MD5 8fa14cdd754f91cc6554c9e71929cce7
- SHA1 4a0a19218e082a343a1b17e5333409af9d98f0f5
- SHA512 711c22448e721e5491d8245b49425aa861f1fc4a15287f0735e203799b65cffec50b5abd0fddd91cd643aeb3b530d48f05e258e7e230a94ed5025c1387bb4e1b
- MD5 SHA1 SHA512
Score

3^/10
behavioral26
- Target
  Solaraً/workspace/.tests/readfile.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral27
- Target
  Solaraً/workspace/.tests/writefile
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

1^/10
behavioral28
- Target
  Solaraً/workspace/.tests/writefile.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

3^/10
behavioral29
- Target
  Solaraً/workspace/EzHubLL.txt
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
Score

3^/10
behavioral30
- Target
  Solaraً/workspace/IY_FE.iy
- Size 539B
- SHA256 73bb58ba5b81960caf5a8e66675cc89b5761b77db99c6ceb9435f7211d400452
- MD5 291d5636a434c4f1ceb0f3f776c2a51f
- SHA1 ae287e08f71c522a72812f0dace94b8ffb569341
- SHA512 7dab8034f85aef1b2b7a86cc8220ebdbb95a3f083d1565e1cff38414367aa69fc597a11aaba11dbef411e13fbfb285855d9c46ae59738f6e88c22dd55c81a743
- MD5 SHA1 SHA512
Score

3^/10
behavioral31
- Target
  Solaraً/workspace/Sky Hub/Sky Hub Settings.json
- Size 52B
- SHA256 37dd2675939dcf754c08d0a3776908fc7c996849839dcba037848a943f33240b
- MD5 9a42aefba1beca2d4816e37142fa22db
- SHA1 387384c567a5bd1ca99568c43315ea39bdaec1e0
- SHA512 77ed2aeab7c10507e74c8001cbafe883d4a308cc3686d0edcf8925db54f00e45337b9ebd7d19c83129cebda0e0eaa9d01a0f5474d0639b6cab5659cfedb80a9b
- MD5 SHA1 SHA512
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Drops file in System32 directory

Credentials from Password Stores: Credentials from Web Browsers

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Credentials from Password Stores: Credentials from Web Browsers

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32