Behavioral task
behavioral1
Sample
Solara/Solara Installer.exe
Resource
win7-20240903-en
General
-
Target
Solara.rar
-
Size
107KB
-
MD5
7e5ede9df260084d69b60071a1a1c9a5
-
SHA1
0fc130884d63b2c0a6d3008304b586733ca1b1d8
-
SHA256
5b60b4da07e1f183af246b3ddd85bf12be3bcf0b0d1005d110daa7fdc8ea125e
-
SHA512
1c7660f9f81a35d0cf20f31e10c944ab2d698bba9e2aebd6fcfe9b330d5eaaac337acd64063ef9146a32dba384fae534170fbeebb03f9cb2b343c4cc2acb0773
-
SSDEEP
3072:RKbiD7af1EgBobkyufH7ol7e+1+A3lwFI34:RwiSf19D187f8A3SFI34
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1303346382320566364/NKw3SHRn53oFiPfzBhnGkM5DJDPNYfTopbE2xqInlxxGUx2Xeo3MNSDPrwfoElJVpQzF
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule static1/unpack001/Solara/Solara Installer.exe family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Solara/Solara Installer.exe
Files
-
Solara.rar.rar
Password: 1
-
Solara/Solara Installer.exe.exe windows:4 windows x86 arch:x86
Password: 1
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ