General

  • Target

    Solara.zip

  • Size

    11.4MB

  • Sample

    250414-wtvk8awrs6

  • MD5

    a42e6c527fc3bf57367b2d016779acc8

  • SHA1

    3735e575b1f821d2262ad12f14aef680b23aca2e

  • SHA256

    eace7dbe1de734d094f6a39b4eee2b3259db02a38f14cdccf3006af7c6b8b3b5

  • SHA512

    45b5544401a34bd88f2cffb8b0674a4659a3895d411e315adbc4c99f87879952f1dfb3bf2780e42c0e3c37079a0abe0a0bec7d5cecf07eb1dec7626a19f72484

  • SSDEEP

    196608:mcfvHBPNq+B0P8YpNo1zfVjuqQiZ26sSfFai02b51kNPve2+Qb4hwee0+nc5:NXRsQ07o1zdUiZjsIJ02b5112+QbKec5

Malware Config

Extracted

Family

rhadamanthys

C2

https://135.181.4.162:2423/97e9fc994198e76/5vasbsn8.w2nxs

Targets

    • Target

      Solara/Solara.exe

    • Size

      432KB

    • MD5

      3ad28512794a4e91397f2903543e7220

    • SHA1

      514e414f6bbcf4fc4991d4df3b48d66c6c8efa8a

    • SHA256

      115c0569f04cd121172cb2b7689a67715db4f7e33cb2c0a04eaa4de59078293b

    • SHA512

      f1dc4a8f6d69cc9589e2dea82aca91c3f46da1d322e0138862d9be3ccd6754c8624cb77b37d8884f7402cc1c747845f10993aa80ac9b50e2f19feaac9589e3a6

    • SSDEEP

      6144:yzEo3MgLXCbN91YdOnCjhIoCQ8uUiEXJTUfs5wOSzmaq55SeFrLVNaG:TQMgAjCaoguvE59uzmaqnx/

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Rhadamanthys family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks