9c37e39fc56c00e762fb652cfe61e1724f1f44e1240196987dc4f6cb4c001d6e

General

Target
Solara-V1.9.7.exe
Size 34.4MB
Sample260718-l4jllaa12v
SHA256 9c37e39fc56c00e762fb652cfe61e1724f1f44e1240196987dc4f6cb4c001d6e
MD5 99d4bcb6a5f14e2c009f60f00643020a
SHA1 b012160499c5176712dbdf5f0715b71e3795a056
SHA512 e4d8f61f3b881838e4e067792fd78ffe43d15fa1c98f721b4889065671ba0d97bb41ea2a9a486b4860e777f536736210a785d2696c1b7f3743311416a4014820
SSDEEP 49152:xVsvYhQz3dcYDWhvZzyJNfwoqkSejP0+6NiwI57RRaBxMaOp:IvYhQztcEYyJdwoqk3s9krNv
TLSH
T11F87D0A59E0EC80FDBAE4FB268D162513C751D68FF28E2875877B4A035F7058AD430E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Solara-V1.9.7.exe
- Size 34.4MB
- SHA256 9c37e39fc56c00e762fb652cfe61e1724f1f44e1240196987dc4f6cb4c001d6e
- MD5 99d4bcb6a5f14e2c009f60f00643020a
- SHA1 b012160499c5176712dbdf5f0715b71e3795a056
- SHA512 e4d8f61f3b881838e4e067792fd78ffe43d15fa1c98f721b4889065671ba0d97bb41ea2a9a486b4860e777f536736210a785d2696c1b7f3743311416a4014820
- SSDEEP 49152:xVsvYhQz3dcYDWhvZzyJNfwoqkSejP0+6NiwI57RRaBxMaOp:IvYhQztcEYyJdwoqk3s9krNv
- TLSH
  T11F87D0A59E0EC80FDBAE4FB268D162513C751D68FF28E2875877B4A035F7058AD430E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection costura discovery execution packer persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2