General
-
Target
SOLARA.exe
-
Size
3.1MB
-
Sample
240702-caldnawaqm
-
MD5
ab7ff5d6187d1849c3039b409e99141d
-
SHA1
3707f5d41fac8281d8e21e1aeeae01673069efa0
-
SHA256
fe2e26a0d2a56163e9139dbc3ac6bd203eed1c972f53a21360164ee9f26cd809
-
SHA512
e541e4539f62ed43492444035294c78cebcb6c47ba3ba82176f9e90f3d2681eea8879143df35196258215b47a12024195f43aec22df0935493de16af2048c809
-
SSDEEP
49152:SvOI22SsaNYfdPBldt698dBcjH/tmxmz/xoGdvTHHB72eh2NT:Svj22SsaNYfdPBldt6+dBcjH/tms
Behavioral task
behavioral1
Sample
SOLARA.exe
Resource
win7-20240419-en
Malware Config
Extracted
quasar
1.4.1
Solara
192.168.0.23:4782
39c5c45c-62a0-4623-a904-5cbad2aa6b55
-
encryption_key
41AD0502F025DD3F47720DC4BDEED540F3EAFD12
-
install_name
securekerneI.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
SubDir
Targets
-
-
Target
SOLARA.exe
-
Size
3.1MB
-
MD5
ab7ff5d6187d1849c3039b409e99141d
-
SHA1
3707f5d41fac8281d8e21e1aeeae01673069efa0
-
SHA256
fe2e26a0d2a56163e9139dbc3ac6bd203eed1c972f53a21360164ee9f26cd809
-
SHA512
e541e4539f62ed43492444035294c78cebcb6c47ba3ba82176f9e90f3d2681eea8879143df35196258215b47a12024195f43aec22df0935493de16af2048c809
-
SSDEEP
49152:SvOI22SsaNYfdPBldt698dBcjH/tmxmz/xoGdvTHHB72eh2NT:Svj22SsaNYfdPBldt6+dBcjH/tms
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-