MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b1954a4479d66d3a49de26b07bec8b4966aa9bb47d0e23815ab4560cf7614aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SolarisLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b1954a4479d66d3a49de26b07bec8b4966aa9bb47d0e23815ab4560cf7614aa
SHA3-384 hash: 9fb5b6543f9c8c8b80170748965671eead219a8666f0311b3a52d0ab33afa78720a34f6714e050e90c1b217fa200644b
SHA1 hash: 397ee881df2f00dd9748dcb25fc7238faf71bb9e
MD5 hash: c19cc92ed0eebefb1201fd06a7af9bf5
humanhash: mississippi-lake-oklahoma-nineteen
File name:0b1954a4479d66d3a49de26b07bec8b4966aa9bb47d0e23815ab4560cf7614aa
Download: download sample
Signature SolarisLoader
Create hunting rule
File size:39'424 bytes
First seen:2026-06-08 09:53:34 UTC
Last seen:2026-06-23 09:20:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9d6b7a90e30c979aada0c2c88281d1b8 (3 x SolarisLoader, 1 x Stealc)
ssdeep 768:+vBc4FsYxddOnewnRyD5+tRkXnCGZAO2k43nJOQVmmIn1hOV:+uesY3CnRy1mRe1ZovZ5VgrOV
TLSH T1BC033B6B3FD61695DC628679C775D23BEEF0B1A4B0206E4F0725CE2AEF23102D520D26
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter adrian__luca
Tags:exe SolarisLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
140
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
0399b51ed74d7a9125dd9908cff4123eed37f551d121d52bf84b4a0995246484.exe
Verdict:
Malicious activity
Analysis date:
2026-06-06 23:33:24 UTC
Tags:
auto generic
Link:
https://app.any.run/tasks/759450f7-272f-4e5a-901d-a0d137d626e1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/69968/
Detection(s):
SecuriteInfo.com.Trojan.Siggen32.42491.22725.1414.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a269150ae2f98c00a68cdfa
Tags:
ransomware
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Searching for synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a process with a hidden window
Sending an HTTP POST request to an infection source
Connection attempt to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context microsoft_visual_cc stealc
Link:
https://www.filescan.io/uploads/6a2691523d2a0c6df8e96b70/reports/ab350046-b21c-4a41-b557-0c5ab2602c78/overview
Verdict:
Malicious
Labled as:
Mint.Phil.Generic
Link:
https://www.hybrid-analysis.com/sample/0b1954a4479d66d3a49de26b07bec8b4966aa9bb47d0e23815ab4560cf7614aa
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-05-16T19:58:00Z UTC
Last seen:
2026-06-09T20:25:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/0b1954a4479d66d3a49de26b07bec8b4966aa9bb47d0e23815ab4560cf7614aa/results?tab=lookup
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/85e49c68-9e6b-4ad3-aecf-782b66fb6fc2
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0b1954a4479d66d3a49de26b07bec8b4966aa9bb47d0e23815ab4560cf7614aa
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b1954a4479d66d3a49de26b07bec8b4966aa9bb47d0e23815ab4560cf7614aa/
Threat name:
Win64.Trojan.MintPhil
Create hunting rule
Status:
Malicious
First seen:
2026-05-16 16:56:05 UTC
AV detection:
25 of 37 (67.57%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/260608-lxf7wsbz2q/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Executes dropped EXE
Unpacked files
SH256 hash:
0b1954a4479d66d3a49de26b07bec8b4966aa9bb47d0e23815ab4560cf7614aa
MD5 hash:
c19cc92ed0eebefb1201fd06a7af9bf5
SHA1 hash:
397ee881df2f00dd9748dcb25fc7238faf71bb9e
Link:
https://www.unpac.me/results/f97c373c-c77c-4cb1-82b7-7aa0227e34f5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0b1954a4479d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.42
Link:
https://yomi.yoroi.company/submissions/0b1954a4479d66d3a49de26b07bec8b4966aa9bb47d0e23815ab4560cf7614aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:Detects Reflective DLL injection artifacts
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Windows_Trojan_CobaltStrike_f0b627fc
Create hunting rule
Description:Rule for beacon reflective loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69968/

Comments