General
-
Target
Solara-main.zip
-
Size
13.2MB
-
Sample
240629-wvgqrasflg
-
MD5
6ec4621ddf57a2f2201b642d27affcae
-
SHA1
e99b752840da5cd66539f1f4a42ce18d2e3d0cc3
-
SHA256
c84516e135100e785a67158af28efdca3914ef7347fc0f1f568a8cca0ff827d1
-
SHA512
0784fe8e83c1d54d0f347df83fade4879e160f42fec39261390f5e5d38cc6c6ee2c7c23746b6e64f8cf1c838f5fe07238d15dfcef526892f4343dfef365d63e8
-
SSDEEP
393216:8UEb4h64DxEwf0ZDJkSpOAWDtnCeYpsAs:8UEbToV0ZDEJnG8
Behavioral task
behavioral1
Sample
Solara-main/Files/SolaraBootstrapper.exe
Resource
win7-20231129-en
Malware Config
Targets
-
-
Target
Solara-main/Files/SolaraBootstrapper.exe
-
Size
13KB
-
MD5
0cc81729f4bd4a6eac95cc442bc8df2a
-
SHA1
5d5f367e720684dd64cfb5340d9911ec0782fdac
-
SHA256
92960ae4a38d896418a14a1db5ba1547aa273443790e858d00dac4ce64550c2a
-
SHA512
f6fc1fca47e4620e24652d8dc2aa88cdd7363172b31122c05d262349aeec88407a2b3fbbc4e4834c359960d4981fb9f674cfbfd9d5743dc917df72a3ebfb3c90
-
SSDEEP
192:+ZnqvqiVx1BLO77IaqaLHmr/XKTxnTjw1hOPVXmNjA:0nCVxoIaqayzKtnw1h6VKj
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-