General

  • Target

    Solara1.25.exe

  • Size

    71.8MB

  • Sample

    241230-d7spnsxjgs

  • MD5

    6b32177d5218d0f5158eb91bfcc54c15

  • SHA1

    19d0b30aa6fe9a5bbc9b583bbd48b70861420b4a

  • SHA256

    822b6bd963cba3c0762d3ddfa83b070c33d9b90eedba798fa5d5436aae491a19

  • SHA512

    39db07ff94dcc915f221f558f69590d32f0fae09bcd2b6d9c2ad01d2af83ef5dca5adbcb3a5d3837aad586232bec400ea8733bfd10c1fb7207017c67e81b171d

  • SSDEEP

    1572864:v9JxSm1WIacirAH8+1osuTCSxOB6xMLiIpB2qHWB75ilQhmqZ8Qry4hlDVgc:fzZRS6xjKcBa6/2qHO5iopyQry4bB

Malware Config

Targets

    • Target

      Solara1.25.exe

    • Size

      71.8MB

    • MD5

      6b32177d5218d0f5158eb91bfcc54c15

    • SHA1

      19d0b30aa6fe9a5bbc9b583bbd48b70861420b4a

    • SHA256

      822b6bd963cba3c0762d3ddfa83b070c33d9b90eedba798fa5d5436aae491a19

    • SHA512

      39db07ff94dcc915f221f558f69590d32f0fae09bcd2b6d9c2ad01d2af83ef5dca5adbcb3a5d3837aad586232bec400ea8733bfd10c1fb7207017c67e81b171d

    • SSDEEP

      1572864:v9JxSm1WIacirAH8+1osuTCSxOB6xMLiIpB2qHWB75ilQhmqZ8Qry4hlDVgc:fzZRS6xjKcBa6/2qHO5iopyQry4bB

    • Enumerates VirtualBox DLL files

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks