General
- Target Solstice.zip
- Size 21.9MB
- Sample260903-l14scsge36
- SHA256 d2e1e3446da4ee17931b7606c1fd0ecfa00f41c2da3a77b5b49c917f7ba15db8
Score
9/10
Malware Config
Targets
-
- Target Bin/Decompiler.exe
- Size 13.2MB
- SHA256 41759a938392788dcc831f0bd6a439d8651c2879f07300aee4d4e7bd9dec3821
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Bin/InjectIntoMyAss.exe
- Size 127KB
- SHA256 ceb872c99ba9dcf798f440ccf05d9f8f29093d26060fc6fa9b02f4d639ba4b69
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Bin/Solstice.dll
- Size 1012KB
- SHA256 14dd86f22c77f73004d265194cd67a552a8f1adeb319ad714a5a1492a79e8e5f
Score1/10 -
- Target Solstice.exe
- Size 9.2MB
- SHA256 60b2e5a9c4d9651eedecbabeb0c23ea6ce0a55f593df11cefab5c1904e1715a1
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Network Share Discovery
Attempt to gather information on host network.
-
Suspicious use of NtSetInformationThreadHideFromDebugger