5c1465b0cb65e9bd6c89f8275c933f63f4030422ec0e86faf519c8f91d2e7a64

Sharing

Copy URL Twitter E-mail

General

Target
SollyFall Setup 1.0.0.exe
Size 108.2MB
Sample260717-ln87bab14t
SHA256 5c1465b0cb65e9bd6c89f8275c933f63f4030422ec0e86faf519c8f91d2e7a64
MD5 582d3bd9cb19f210031087c1aa5e7c67
SHA1 8e9e452fe85acaaba0b181d52210e4e56512651e
SHA512 43526b7b8ce970dade3556dafb1ec1acc750055d7fe642cc80046e7c750c39582d03b3e42a0f7f3061fcd3583429dcb5320d74b2adac1c1f9622661bb8cbee49
SSDEEP 1572864:HzlH6bcTZkU/fnr9PZpqY1t/j3Of7LqFdzLcBdyNyB13jSQDOqxW41Z:HzN6bcuwxPTUPqFdncBdyNsSV4L
TLSH
T1D048338CD4E3597AE8FBB83CD192BE60051A31F95F701AC3DBB92EAD36614611B27704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  SollyFall Setup 1.0.0.exe
- Size 108.2MB
- SHA256 5c1465b0cb65e9bd6c89f8275c933f63f4030422ec0e86faf519c8f91d2e7a64
- MD5 582d3bd9cb19f210031087c1aa5e7c67
- SHA1 8e9e452fe85acaaba0b181d52210e4e56512651e
- SHA512 43526b7b8ce970dade3556dafb1ec1acc750055d7fe642cc80046e7c750c39582d03b3e42a0f7f3061fcd3583429dcb5320d74b2adac1c1f9622661bb8cbee49
- SSDEEP 1572864:HzlH6bcTZkU/fnr9PZpqY1t/j3Of7LqFdzLcBdyNyB13jSQDOqxW41Z:HzN6bcuwxPTUPqFdncBdyNsSV4L
- TLSH
  T1D048338CD4E3597AE8FBB83CD192BE60051A31F95F701AC3DBB92EAD36614611B27704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution spyware stealer trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 11.7MB
- SHA256 5d67aba37acc9e0e0a88546d940ed23f29ea3441aac7dd06dcc08a1b1c93b0a9
- MD5 0b24e08f0d1dac2ee54364e50fef0b41
- SHA1 a4f3ea66556cdcc2e92bc924965e225488ccd94b
- SHA512 2beb14f31a87f0df953af26945288f35e916159b114ec1c205c3a58125fa6911b888c2a0b17b593c5b2bcd8e51012d8f2cbe4629f1968335ee3866a19712dfb9
- SSDEEP 24576:S9dQL6poq6jBCjK6D3UwRmETlmfTKjZ6ojK6QjZ6UjK6ajK64jK6cjZ6ijK6b6ck:SvPeGAyWPbX8meu
- TLSH
  T1CBC6A52F7B48037306C642A26B8B65CAF31F903F3B561654345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  locales/mr.pak
- Size 1.2MB
- SHA256 0eae188c9a81bd3257a21dc28448b5e9e5c3f4f4de4dc8e178e7f13cab06d6f7
- MD5 b7fd0eb57e0a1266990bdd0b405675b2
- SHA1 74becbfb683508912e703f31c650cb29057f1f74
- SHA512 e6fb9760d62051f1185b060e8288c56b95e3e8d701767d8645ee9cd464993b76c78aff365f401a56e391d63857307827d716ba026bb5e4712444b09b0ddeea4b
- SSDEEP 3072:rMfCBVYlp+n/4xasCPLmFZfr1iuJvm89/njU6TkeInVEwFEyGRg3R5QodgEPYyla:Q6DYL+CZTYgKZOa3Vq9X5km/Iwp
- TLSH
  T10345C24DF7BAF3685DACBC8E36540D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- MD5 0b33e83d33b01a51625a0fdcbef42ce3
- SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
- TLSH
  T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- TLSH
  T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/datavault-win/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- MD5 0b33e83d33b01a51625a0fdcbef42ce3
- SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
- TLSH
  T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/datavault-win/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- TLSH
  T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
- Size 1.8MB
- SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- MD5 66a65322c9d362a23cf3d3f7735d5430
- SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
- TLSH
  T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size 224B
- SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- MD5 f0a82a6a6043bf87899114337c67df6c
- SHA1 a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA512 d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
- TLSH
  T13FD0A71002D514F489B0BF80E49F0B163DC781E33B026450DC8888512BD72A3608AD9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
- Size 59B
- SHA256 762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- MD5 8582b2dcaed9c5a6f3b7cfe150545254
- SHA1 14667874e0bfbe4ffc951f3e4bec7c5cf44e5a81
- SHA512 22ec4df7697322b23ae2e73c692ed5c925d50fde2b7e72bfc2d5dd873e2da51834b920dea7c67cca5733e8a3f5e603805762e8be238c651aa40290452843411d
- TLSH
  T1D1A002D1B590B39576E44054E5D486821C91C1E1A5535AA0C14986A51C4888055159A0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
- Size 6KB
- SHA256 8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- MD5 275019a4199a84cfd18abd0f1ae497aa
- SHA1 8601683f9b6206e525e4a087a7cca40d07828fd8
- SHA512 6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0
- SSDEEP 192:QoM2Wd0WmO6pM+tPtVRhoh3hG/h1goWPQfAcCy7gPQbQwZQiR893+9dY:npM0I6aPkd/K
- TLSH
  T1A3D1514DEAE36434962F76E9861FA65930398547347C8A417D8EC3901FB5C2036ABFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
- Size 1KB
- SHA256 d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- MD5 e5c2de3c74bc66d4906bb34591859a5f
- SHA1 37ec527d9798d43898108080506126b4146334e7
- SHA512 e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5
- TLSH
  T14421C18C5CD370A59B63F0AC636BA00C7579191330A4C590758CC350DFD1D6A87A3E9D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32