🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dccb865fd6ea565761ae3407f7e67dedc44acb59ec2568c1d26e002c8dd1e5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SolarisLoader


Vendor detections: 19


Intelligence 19 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0dccb865fd6ea565761ae3407f7e67dedc44acb59ec2568c1d26e002c8dd1e5c
SHA3-384 hash: d4460e224279bf63357e4a0c4ceb4fa4070d49d4df61cc198f3f4d2cb94c8b7ec114f323915ad35a2a3d4d8cf8bc0a86
SHA1 hash: 669b7c85b2949e52daf3e8e218a5661970731661
MD5 hash: e92e421fb588e880c229970ff4e04dc5
humanhash: freddie-lemon-april-missouri
File name:1.exe
Download: download sample
Signature SolarisLoader
Create hunting rule
File size:84'074 bytes
First seen:2026-11-13 08:49:41 UTC
Last seen:2026-11-13 09:31:56 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 5110847ea72bd3a6f930849e2c3f6343 (1 x SolarisLoader)
ssdeep 1536:2n6ebbxa01ApMKJ7JcGPsdi+beiEo6/FGqI6CO5t4yrqdy:CtbbQ0KRNsdi+Uo6dvjCAlrcy
TLSH T14A834AF46AD182F6D813CA31E5BA536BEB70F9426735430F4360CA1D1F93A81BD1CA59
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe SolarisLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
206
Origin country :
FR FR
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c53f1aa1-96d8-43a5-978e-f4bc1921a4fa/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-13 08:53:28 UTC
Tags:
solaris loader xor-url generic
Link:
https://app.any.run/tasks/eec283d4-47b3-4529-b7c5-cb347d6e3e50

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99775/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af6cf6583200b505eda5fe4
Tags:
ransomware injection agentb virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating synchronization primitives
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Searching for synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Creating a window
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Sending an HTTP POST request
Creating a file
Deleting a recently created file
Reading critical registry keys
Launching a process
Replacing executable files
Connection attempt to an infection source
Stealing user critical data
Unauthorized injection to a recently created process by asynchronous procedure call
Creating a file in the mass storage device
Enabling autorun by creating a file
Unauthorized injection to a system process
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Infecting executable files
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug crypto fingerprint keylogger obfuscated overlay reconnaissance
Link:
https://www.filescan.io/uploads/6af6cf47dffef28c4f4ee2c7/reports/e6470021-db03-4863-b8bd-d284537cfbf8/overview
Verdict:
Malicious
Labled as:
Mint.Zard.Generic
Link:
https://www.hybrid-analysis.com/sample/0dccb865fd6ea565761ae3407f7e67dedc44acb59ec2568c1d26e002c8dd1e5c
Verdict:
Malicious
File Type:
exe x64
Link:
https://opentip.kaspersky.com/0dccb865fd6ea565761ae3407f7e67dedc44acb59ec2568c1d26e002c8dd1e5c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c31449ef-42c9-4556-8e4d-fe9604ebbe5d
Result
Threat name:
SolarisLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2005231
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Contains functionality to log keystrokes
Creates a thread in another existing process (thread injection)
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queries Google from non browser process on port 80
Sample uses string decryption to hide its real strings
Sets debug register (to hijack the execution of another thread)
Tries to detect sleep reduction / modifications
Writes to foreign memory regions
Yara detected SolarisLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2005231 Sample: 1.exe Startdate: 13/11/2026 Architecture: WINDOWS Score: 100 49 www.google.com 2->49 55 Found malware configuration 2->55 57 Malicious sample detected (through community Yara rule) 2->57 59 Antivirus detection for URL or domain 2->59 61 6 other signatures 2->61 8 1.exe 1 16 2->8         started        13 cnokb.exe 2->13         started        15 explorer.exe 13 8 2->15 injected 17 sihost.exe 2->17 injected signatures3 process4 dnsIp5 51 193.178.158.57, 49717, 49718, 49719 IPC-ASRU Russia 8->51 53 www.google.com 142.251.154.119, 443, 49713, 49714 GOOGLE-GoogleLLCUS United States 8->53 41 C:\Users\user\AppData\Roaming\...\cnokb.exe, PE32+ 8->41 dropped 43 C:\Users\user\AppData\Local\...\v0f5gtdw.exe, PE32+ 8->43 dropped 45 C:\Users\user\AppData\Local\...\qghj7oqq.exe, PE32+ 8->45 dropped 47 6 other malicious files 8->47 dropped 63 Changes the view of files in windows explorer (hidden files and folders) 8->63 65 Contains functionality to inject threads in other processes 8->65 67 Injects code into the Windows Explorer (explorer.exe) 8->67 77 10 other signatures 8->77 69 Antivirus detection for dropped file 13->69 71 Found evasive API chain (may stop execution after checking mutex) 13->71 73 Modifies the context of a thread in another process (thread injection) 13->73 75 Tries to detect sleep reduction / modifications 13->75 19 cmd.exe 15->19         started        21 cmd.exe 15->21         started        23 cmd.exe 15->23         started        25 4 other processes 15->25 file6 signatures7 process8 process9 27 conhost.exe 19->27         started        29 conhost.exe 21->29         started        31 conhost.exe 23->31         started        33 conhost.exe 25->33         started        35 conhost.exe 25->35         started        37 conhost.exe 25->37         started        39 conhost.exe 25->39         started       
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0dccb865fd6ea565761ae3407f7e67dedc44acb59ec2568c1d26e002c8dd1e5c
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/e92e421fb588e880c229970ff4e04dc5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0dccb865fd6ea565761ae3407f7e67dedc44acb59ec2568c1d26e002c8dd1e5c/
Threat name:
Win64.Trojan.MintZard
Create hunting rule
Status:
Malicious
First seen:
2026-11-11 07:20:35 UTC
File Type:
PE+ (Exe)
AV detection:
21 of 36 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bxglqzp5n2swk5q24nah67th33oejlfvt3bfnda5e3qafsg5dzoa._file
Result
Malware family:
solaris_loader
Create hunting rule
Score:
  10/10
Tags:
family:solaris_loader defense_evasion discovery execution loader persistence privilege_escalation
Link:
https://tria.ge/reports/261113-krr7jahz4r/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Executes dropped EXE
Family: SolarisLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
193.178.158.57
193.178.158.107
196.251.107.186
Malware Family:
SolarisLoader
Create hunting rule
Verdict:
Malicious
Tags:
solarisloader config_extracted stealer injector loader evasion rat
YARA:
SUSP_XORed_Mozilla CreateScheduledTask
Link:
https://app.threat.zone/submission/4472c299-823c-4a4d-8cd8-87db391db126
Malware Config
C2 Extraction:
193.178.158.57
193.178.158.107
196.251.107.186
Malware Family:
mint
Create hunting rule
Malicious:
True
Tags:
exe 64bit exec file-overlay
Link:
https://intel.virussign.com/intelligence/file/0dccb865fd6ea565761ae3407f7e67dedc44acb59ec2568c1d26e002c8dd1e5c
Unpacked files
SH256 hash:
0dccb865fd6ea565761ae3407f7e67dedc44acb59ec2568c1d26e002c8dd1e5c
MD5 hash:
e92e421fb588e880c229970ff4e04dc5
SHA1 hash:
669b7c85b2949e52daf3e8e218a5661970731661
Detections:
SUSP_XORed_Mozilla
Create hunting rule
Link:
https://www.unpac.me/results/bc99ed3c-f445-4229-a3a9-9c243c86064c/
Malware family:
SolarisLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0dccb865fd6e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0dccb865fd6ea565761ae3407f7e67dedc44acb59ec2568c1d26e002c8dd1e5c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:Hunt_Obfuscated_Localhost_ROT
Create hunting rule
Author:Serhii Kocherhan
Description:Detects obfuscated/rotated 127.0.0.1 strings while excluding raw plaintext
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:WIN_Malware_SliverFox_ForgeAuto_c1e18461
Create hunting rule
Author:Marjoriefort
Description:Detects SliverFox (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SolarisLoader

Executable exe 0dccb865fd6ea565761ae3407f7e67dedc44acb59ec2568c1d26e002c8dd1e5c

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/99775/
  
URLhaus
https://urlhaus.abuse.ch/url/4035713/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/4035716/

Comments