Overview

overview

8

Static

static

1

SolaraBoot...2).exe

windows7-x64

7

SolaraBoot...2).exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SolaraBootstrapper (2).exe

  • Size

    14.7MB

  • Sample

    240705-c933ratamc

  • MD5

    574d7b18b6ba272552b39ddfa54a60ca

  • SHA1

    8458ff8150611486a89a990f39a788eb1de94d01

  • SHA256

    347743a762f65cb091a86db4f85a2701a4888393e460b9cade5d537d1db21be1

  • SHA512

    fc122163000f5bb027e34ba2c4020f622bb77c44b86d2abf7ad7ad4df84ab067c73dacb3319282fceff78b06ec0abff1b7b5fdfb1cbee9069e805911b9fced71

  • SSDEEP

    393216:Ya92bgIF5L1V8diurEUWjuzKnpEfOKSUuK+xh:j947RFdbu2npqS7K+/

Score
8/10
defense_evasionexecutionspywarestealerupx

Malware Config

Targets

    • Target

      SolaraBootstrapper (2).exe

    • Size

      14.7MB

    • MD5

      574d7b18b6ba272552b39ddfa54a60ca

    • SHA1

      8458ff8150611486a89a990f39a788eb1de94d01

    • SHA256

      347743a762f65cb091a86db4f85a2701a4888393e460b9cade5d537d1db21be1

    • SHA512

      fc122163000f5bb027e34ba2c4020f622bb77c44b86d2abf7ad7ad4df84ab067c73dacb3319282fceff78b06ec0abff1b7b5fdfb1cbee9069e805911b9fced71

    • SSDEEP

      393216:Ya92bgIF5L1V8diurEUWjuzKnpEfOKSUuK+xh:j947RFdbu2npqS7K+/

    Score
    8/10
    upxdefense_evasionexecutionspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks