solaris_loader | 8c82f607f14980a6962993f8800cdf35[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
8c82f607f14980a6962993f8800cdf35.exe
Size 60KB
Sample260910-c54hqavaph
SHA256 953b808caf22274577e975b21404fcd2b69fb3e8ad266f175b100612305d5575
MD5 8c82f607f14980a6962993f8800cdf35
SHA1 2217b5efd0ba9f67a74fe95ac7fff491816f0ddf
SHA512 1671130d36849ac835d5b10d9f175ece6230953afdd47489ef26bd8802976d6dd5c0a5205121dbf366320ddb878db7aef8392a143ef785bf9cef16f080e940a0
SSDEEP 1536:1KWHka5dALVp1V8YJVqJMX0jl0w15GXC0rOB7CD:1Km5dAppRdX0jlP1wT0E
TLSH
T1CF533B59A6DE624CD836C4B4E6A5D333EBA3F8427335974F0532C81E0F22B16BD28E05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

loader solaris_loader

Malware Config

Extracted

Family

solaris_loader

196.251.107.186
192.162.199.186
196.251.107.163

Signatures

Family: SolarisLoader
SolarisLoader is a Windows loader written in C.
loader solaris_loader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c82f607f14980a6962993f8800cdf35.exe

File Explorer

8c82f607f14980a6962993f8800cdf35.exe

.exe 60KB

8c82f607f14980a6962993f8800cdf35.exe

IMPHASH 565603945ab9e2df0a0749884929091f
SHA256 953b808caf22274577e975b21404fcd2b69fb3e8ad266f175b100612305d5575
MD5 8c82f607f14980a6962993f8800cdf35
SHA1 2217b5efd0ba9f67a74fe95ac7fff491816f0ddf
SHA512 1671130d36849ac835d5b10d9f175ece6230953afdd47489ef26bd8802976d6dd5c0a5205121dbf366320ddb878db7aef8392a143ef785bf9cef16f080e940a0
SSDEEP 1536:1KWHka5dALVp1V8YJVqJMX0jl0w15GXC0rOB7CD:1Km5dAppRdX0jlP1wT0E
TLSH
T1CF533B59A6DE624CD836C4B4E6A5D333EBA3F8427335974F0532C81E0F22B16BD28E05
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess GetCurrentProcessId ExitProcess CreateThread ProcessIdToSessionId OpenProcess GetTickCount GetSystemDirectoryW VirtualProtect IsWow64Process GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW lstrcmpiW lstrcpyW lstrcatW lstrlenW CopyFileW MoveFileExW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateFileMappingW MapViewOfFile UnmapViewOfFile SetFileTime WideCharToMultiByte GlobalMemoryStatusEx OpenMutexW WriteFile GetTempPathW SetEvent WaitForSingleObject CreateEventW TerminateProcess ResumeThread CreateProcessW GetThreadContext SetThreadContext WriteProcessMemory MultiByteToWideChar SetThreadPriority GlobalAlloc GlobalUnlock GlobalLock GlobalFree CreateRemoteThread VirtualAllocEx GetThreadId SetFileAttributesW ReadFile GetFileTime GetFileSize DeleteFileW Sleep CreateMutexW GetProcessHeap HeapFree HeapAlloc GetLastError GetComputerNameW CloseHandle CreateFileW lstrcmpA GetEnvironmentVariableW

winhttp

WinHttpConnect WinHttpReadData WinHttpCloseHandle WinHttpOpen WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

wininet

InternetCloseHandle InternetOpenUrlW InternetReadFile HttpQueryInfoW InternetOpenW

ntdll

NtWriteVirtualMemory NtUnmapViewOfSection NtProtectVirtualMemory NtAllocateVirtualMemory

user32

GetClipboardSequenceNumber SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable GetSystemMetrics GetDC ReleaseDC ToUnicodeEx GetKeyboardLayout TranslateMessage CloseClipboard PeekMessageW PostThreadMessageW PostQuitMessage IsWindow GetAsyncKeyState GetKeyboardState MsgWaitForMultipleObjects GetForegroundWindow GetWindowTextW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx OpenClipboard DispatchMessageW wsprintfW

advapi32

OpenProcessToken GetUserNameW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey GetTokenInformation RegSetValueExW

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject BitBlt

shell32

ShellExecuteW SHCreateDirectoryExW

ole32

CreateStreamOnHGlobal CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString

Name

.text

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

684B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

8c82f607f14980a6962993f8800cdf35.exe

kernel32

winhttp

wininet

ntdll

user32

advapi32

gdi32

shell32

ole32

oleaut32

generic