General
-
Target
SolaraB2.exe
-
Size
48KB
-
Sample
241202-w16baswmbv
-
MD5
71fe70139bb3fc78601c7c3da0df9cb2
-
SHA1
ed8a1fb5abd05d948d9adb4a8257788b768e3d38
-
SHA256
18ed10ae7b3ed84595be2e012aa64544ba5751eca4edfa310d7de939f75e822f
-
SHA512
173a90f29874165342764835bd25d3c10dd27f615015104367897a9a50ce4a5ddc9880e6468df7ccedcf6cf2d3f6a9c26d492b5a5dade8c8b0e9795b82c53f30
-
SSDEEP
768:euir1TUEFSuWUoV3kmo2qzHl7VZcJIPIKamfZ0bn9bmIA5WS9bdXm2BDZzN:euir1TUKP28cJtKa6ebnQbWmb9mYdzN
Behavioral task
behavioral1
Sample
SolaraB2.exe
Resource
win7-20241023-en
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
R3dAGQsLxm1j
-
delay
3
-
install
true
-
install_file
solara.exe
-
install_folder
%AppData%
Targets
-
-
Target
SolaraB2.exe
-
Size
48KB
-
MD5
71fe70139bb3fc78601c7c3da0df9cb2
-
SHA1
ed8a1fb5abd05d948d9adb4a8257788b768e3d38
-
SHA256
18ed10ae7b3ed84595be2e012aa64544ba5751eca4edfa310d7de939f75e822f
-
SHA512
173a90f29874165342764835bd25d3c10dd27f615015104367897a9a50ce4a5ddc9880e6468df7ccedcf6cf2d3f6a9c26d492b5a5dade8c8b0e9795b82c53f30
-
SSDEEP
768:euir1TUEFSuWUoV3kmo2qzHl7VZcJIPIKamfZ0bn9bmIA5WS9bdXm2BDZzN:euir1TUKP28cJtKa6ebnQbWmb9mYdzN
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-