redtiger | Solara[.]exe

General

Target
Solara.exe
Size 526KB
Sample250104-q3ba2strdm
SHA256 7494b75566c33c247a381887f26054acc2ea068c2485d5d0cef2fca6812e70e6
MD5 51749a96a9d6c32d40c490e370f1c6c5
SHA1 e4c5b079a557e452b19c24ee8e09d45c0d87df23
SHA512 e4c20bd1bab6f0ef9cea473498d108eda1cf01a29c59da986c350a0834b8fc2d892f6a8810268a2233091d266d4adc4d79699946d974f38672f9815f3b1116f8
SSDEEP 12288:rztE0u86qlmk/5i8go6BrwSMpZg+GBv0JYlCaVJ34:rO0uYlmsD6dGUvHlvJ34
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealer redtiger

Malware Config

Signatures

Detects RedTiger Stealer 7 IoCs

stealer

resource	yara_rule
sample	redtigerv122
sample	redtigerv22
sample	redtiger_stealer_detection
sample	redtiger_stealer_detection_v2
sample	staticSred
sample	staticred
sample	redtiger_stealer_detection_v1

Redtiger family
redtiger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Solara.exe

File Explorer

Solara.exe

.exe 526KB

Solara.exe

IMPHASH 3ccbd572e5c574aa059c8de8b80553b8
SHA256 7494b75566c33c247a381887f26054acc2ea068c2485d5d0cef2fca6812e70e6
MD5 51749a96a9d6c32d40c490e370f1c6c5
SHA1 e4c5b079a557e452b19c24ee8e09d45c0d87df23
SHA512 e4c20bd1bab6f0ef9cea473498d108eda1cf01a29c59da986c350a0834b8fc2d892f6a8810268a2233091d266d4adc4d79699946d974f38672f9815f3b1116f8
SSDEEP 12288:rztE0u86qlmk/5i8go6BrwSMpZg+GBv0JYlCaVJ34:rO0uYlmsD6dGUvHlvJ34
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects RedTiger Stealer

stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

40624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW CreateThread DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSize GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.BSS

Size

325KB

Virtual Size

325KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

Solara.exe

kernel32

generic