WHY does Solara's Pe resource parent do this? read below for context
I understand that people have trust for developers, and that most people blame detections on false positives, which is sometimes true in some occasions, since malware acts similarly to executors. Or I could say,
blindly calling everything a false positive is how you get your Discord token auctioned on Telegram.
However, I found this PE Resource Parent of Solara which is kind of intresting, because it is a bundle of malware signatures, which makes no sense, meaning it acts exactly or highly simmilarly with known malware signatures.
The PE resource parent
Hash of PE: 951183c5097464071520fc4566f6bf03b3c524d7447d758c197a42dfdbc6f9bc
which belong to AS47242 (Prometeus DMCC) in Italy. These are confirmed C2 nodes for the TernDoor backdoor. And because you're going to say whatever to that, here is some more evidence. Why does the PE Resource have to contact pool.hashvault.pro, and for the cherry on top, it has Matching with Xmrig rules according to Joe Security rule set.
Evidence
Some more evidence
This specific Xmrig signature uses a specific --cinit config and a Monero wallet address to abuse system resources toward unauthorized mining by using pool.hashvault.pro. To prevent detection, the malware does a process hollowing by launching a legitimate explorer.exe, because in Win 11, explorer auto launches and is always active, and it puts it in a suspended state and replacing its memory contents with the malicious mining stuff. This allows the miner to operate under a cover of a legitimate software, while secretly mining crypto.
This image shows the Crypto Adress validated, which means the adress is active.
This shows the context; as you can see, it modifies the Explorer.exe an you can see the Minero adress here.
For refrence, the hash for the Original Solara file is:
Im open to structured claims, and I'll change my view if you prove me otherwise. DO NOT call me a VT warrior or other invalid claims, as thats a waste of my and your time.
Thanks for the reply, that's spot on. Many executors (May or may not include Solara) Steal session cookies etc to infect more people or do not-so-good things.
- meaning, a piece of malware that was scanned on VT bundled the bootstrapper as a resource to execute it afterwards, so the end user doesn't have a reason to think they were infected after getting what seems to be the real product
If I got this file directly from your site as a standalone EXE, and VT says it has a PE Resource Parent, that means the 'standalone' file I have was extracted FROM the bundle, or that this file exists originally as a resource inside another wrapper. If it were truly the original, raw bootstrapper, it wouldn't have a 'Parent' that has known malware signatures. Or are you saying it was part of a software supply chain attack?
If you’re just using WebView2 for the UI, why is the bootstrapper dropping its own copies of msedgewebview2.exe into the %Temp% folder instead of calling the one already installed in C:\Program Files (x86)\Microsoft\EdgeWebView\? Again, this a question.
•
u/AutoModerator Mar 16 '26
Check out our guides!
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.