General
-
Target
SolaraB.exe
-
Size
3.1MB
-
Sample
240705-pwm6laycnp
-
MD5
d108c0f1f8c55e42ab067537cdeeaa48
-
SHA1
6983decbfae57b6f2fc2c47220b89f21781cff96
-
SHA256
c3b85f4e668bdfce101e14bd55ca6a0f0192e5514285bb625e86c60f0a2cae23
-
SHA512
45b486564aa6a1bcebf26f1e590d58a8a066c1a0bbb71e96c0ab857375bd225c39635fda2ae109aae12cf08535c76aa505d3dbc374694364c70937737034ea9a
-
SSDEEP
49152:DvHI22SsaNYfdPBldt698dBcjH9ERJ6SbR3LoGdJjTHHB72eh2NT:Dvo22SsaNYfdPBldt6+dBcjH9ERJ6M
Behavioral task
behavioral1
Sample
SolaraB.exe
Resource
win7-20240704-en
Malware Config
Extracted
quasar
1.4.1
Solara
review-lambda.gl.at.ply.gg:60595
fb5df469-592e-42a2-af6e-b4d18d9bb819
-
encryption_key
5F525286F91E7CDC0AF8D2D67907DD091A941ED7
-
install_name
Windows.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows
-
subdirectory
Windows
Targets
-
-
Target
SolaraB.exe
-
Size
3.1MB
-
MD5
d108c0f1f8c55e42ab067537cdeeaa48
-
SHA1
6983decbfae57b6f2fc2c47220b89f21781cff96
-
SHA256
c3b85f4e668bdfce101e14bd55ca6a0f0192e5514285bb625e86c60f0a2cae23
-
SHA512
45b486564aa6a1bcebf26f1e590d58a8a066c1a0bbb71e96c0ab857375bd225c39635fda2ae109aae12cf08535c76aa505d3dbc374694364c70937737034ea9a
-
SSDEEP
49152:DvHI22SsaNYfdPBldt698dBcjH9ERJ6SbR3LoGdJjTHHB72eh2NT:Dvo22SsaNYfdPBldt6+dBcjH9ERJ6M
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-