Solara.zip
- SHA256 d999208640743aef67eac9544824e1e96176dbb73b17fad5d2f33f73fb8fa87e
Behavioral task
behavioral1
Sample
Solara.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
SolaraFixer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
30 signatures
150 seconds
General
- Target Solara.zip
- Size 198KB
- Sample240902-ynvp5swclq
- SHA256 d999208640743aef67eac9544824e1e96176dbb73b17fad5d2f33f73fb8fa87e
- MD5 ffe29b3ebc9256701b01e953113ac2c4
- SHA1 87921716634e010e783122a531a3c46a59fa0a3f
- SHA512 99d47a9f06c8dff272d52439566b799b1a8718b4c5e0993add2256ca06a9a332f65d8084f3c7234b71e217e9994d4ca42f852a285c84940dccd5d2d79b3742ba
- SSDEEP 3072:OEewTb7xmM2+VQiuLsxSII2FluWh4CefBEhdWZb7CjES1TaQQBGzNNCAz146HiMz:nv9pfVPxj0CWBpb7+nIQ9WsrqHkPf9
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
xworm
C2
-
127.0.0.1:13970
-
accessories-retrieve.gl.at.ply.gg:13970
Attributes
-
Install_directory
%AppData%
-
install_file
Loader.exe
Signatures
- Detect Xworm Payload 2 IoCs
resource yara_rule static1/unpack001/Solara.exe family_xworm static1/unpack001/SolaraFixer.bat family_xworm - Xworm family
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Bootstrapper.exe unpack001/Solara.exe unpack001/SolaraFixer.bat
File Explorer
-
Solara.zip.zip 198KB
-
Bootstrapper.exe.exe 104KB
-
Solara.exe.exe 439KB
-
SolaraFixer.bat.exe 86KB
Bootstrapper.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6a850e209de722ad4f57dd68f8af405d62ad6557772717bbd86052d1fe43910f
- MD5 7776882352548456cfc6f9827572d724
- SHA1 22785b7dac19933527255ef7a96fb331f7a455a5
- SHA512 9d0cdc083f75bf524484c231a69e5179bdcc6a6b4ab845ede88aa9ef0f336b0d3d67e90752c545272958f82d8f4fdd1293bd070bd56a3cadaa252d2b53e864e2
- SSDEEP 3072:CugCCyYwC+M2FE6CyYwC+M2FEa80IZOAr:CtChY7X2K6hY7X2Kah
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
89982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\danie\source\repos\debug\debug\obj\Debug\debug.pdb
mscoree
_CorExeMain
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Solara.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 def6f4ec76d2069322983c6eca95a313cb9a8d2456447dae67db7cb1dfe3acdd
- MD5 bbc212bd99b3cdbdf9ebea621b2ec078
- SHA1 31b3bd37ea5c37ee034ed92c3643fef177b130e5
- SHA512 286e2dbe13d9e3732406bda3d55a1a673deb1c8f81669d8d8dc1d2bc5e30f2e8dbd13fc59bef3d13417afc1427243c51223d754422b2efd45b20600987c11737
- SSDEEP 1536:Y52g9057DKXIvjKqx+bSIijoJLU6Bv0JVOfCTPnlp4Z9l:42V8q+bSIjv07Oq734ZP
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
85326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
363KB
Virtual Size
362KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SolaraFixer.bat
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c3ea1603378e0bfbf7fcc64643144c0c5c699bcffc8505b68a251d00097a0c63
- MD5 28b71b14a91dc144298ac43e725d27fd
- SHA1 e6b8bd585e2dabc43d2dbbe6352eac60bdf93ac3
- SHA512 58446084d1e6365d017a0fac0ba10877b7e96a7dbacfb99dc375a65ce5716611cc341653006c043cd3968556c1d2e0559ebbf161c5c25db18ae23716654218f7
- SSDEEP 1536:0PJQdYi/z5s3d434+UHnaJCt53ZbHDSXtDq1MO6tXlMFjGkOWCK4vOnOS:2JQdhatn1HnaJCtRZbHDekadlMJDOWC
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
93726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ