General

  • Target

    Solara New Bootstrapper_10282148.exe

  • Size

    5.7MB

  • Sample

    241108-1s3yestjgr

  • MD5

    15d1c495ff66bf7cea8a6d14bfdf0a20

  • SHA1

    942814521fa406a225522f208ac67f90dbde0ae7

  • SHA256

    61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42

  • SHA512

    063169f22108ac97a3ccb6f8e97380b1e48eef7a07b8fb20870b9bd5f03d7279d3fb10a69c09868beb4a1672ebe826198ae2d0ea81df4d29f9a288ea4f2b98d8

  • SSDEEP

    98304:+j8ab67Ht6RL8xpH4Tv7wPV6osBsBpPj7cZ+KCojTeEL78rqNkIi+bn:+j8aatLPV6oPrk38rqNj

Malware Config

Targets

    • Target

      Solara New Bootstrapper_10282148.exe

    • Size

      5.7MB

    • MD5

      15d1c495ff66bf7cea8a6d14bfdf0a20

    • SHA1

      942814521fa406a225522f208ac67f90dbde0ae7

    • SHA256

      61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42

    • SHA512

      063169f22108ac97a3ccb6f8e97380b1e48eef7a07b8fb20870b9bd5f03d7279d3fb10a69c09868beb4a1672ebe826198ae2d0ea81df4d29f9a288ea4f2b98d8

    • SSDEEP

      98304:+j8ab67Ht6RL8xpH4Tv7wPV6osBsBpPj7cZ+KCojTeEL78rqNkIi+bn:+j8aatLPV6oPrk38rqNj

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks