Overview

overview

7

Static

static

3

SolaraBoot...er.exe

windows7-x64

1

SolaraBoot...er.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SolaraBootStrapper.exe

  • Size

    971KB

  • Sample

    240928-ajma7sxakm

  • MD5

    2458f330cda521460cc077238ab01b25

  • SHA1

    13312b4dffbdda09da2f1848cc713bbe781c5543

  • SHA256

    dc67b264b90e29cf5cffed4453de4567398faa7f3bf18e69e84033c5b33ab05c

  • SHA512

    8f027ebd96901f5a22aad34191244b1786dfb66843cbe05a8470d930415d85d86430267da09e7f1a69b8011b170d229e7fb25ecf0bf7d9209d7b910b2cbab48b

  • SSDEEP

    12288:SKAnSKWYWXlX12QmVdooRkajphRdP7E10TjHeApBH:vAVWbm0oRkajjRZ7Q0PHeS

Score
7/10
discovery

Malware Config

Targets

    • Target

      SolaraBootStrapper.exe

    • Size

      971KB

    • MD5

      2458f330cda521460cc077238ab01b25

    • SHA1

      13312b4dffbdda09da2f1848cc713bbe781c5543

    • SHA256

      dc67b264b90e29cf5cffed4453de4567398faa7f3bf18e69e84033c5b33ab05c

    • SHA512

      8f027ebd96901f5a22aad34191244b1786dfb66843cbe05a8470d930415d85d86430267da09e7f1a69b8011b170d229e7fb25ecf0bf7d9209d7b910b2cbab48b

    • SSDEEP

      12288:SKAnSKWYWXlX12QmVdooRkajphRdP7E10TjHeApBH:vAVWbm0oRkajjRZ7Q0PHeS

    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks