General
- Target Solara_obfuscated.bat
- Size 4KB
- Sample260704-2v2c2saw9m
- SHA256 4afa9ad892c505f9f3cb7a04a67a028c15ee224de337aa9f7a104a575be9fafb
Score
9/10
Malware Config
Targets
-
- Target Solara_obfuscated.bat
- Size 4KB
- SHA256 4afa9ad892c505f9f3cb7a04a67a028c15ee224de337aa9f7a104a575be9fafb
Score9/10-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Share Discovery
Attempt to gather information on host network.
-
Enumerates processes with tasklist
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1