SolarisLoader

Key Takeaways

• Kernel-Level Defense Dismantling: SolarisLoader utilizes a "Bring Your Own Vulnerable Driver" (BYOVD) technique, exploiting a vulnerable Safetica endpoint protection driver (CVE-2026-0828) to gain kernel-level access and forcibly terminate security processes.
• Telemetry Blinding: The malware prevents the operating system from logging or reporting malicious activity by patching the Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) in memory via direct opcode modification.
• Resilient Triple-Layer Persistence: The infection survives standard cleanup through a combination of scheduled tasks, registry-backed backups (ICtrlData), and a watchdog process that injects code into legitimate system files like RuntimeBroker.exe.
• ANY.RUN’s Interactive Sandbox analysis confirms that the loader utilizes a silent COM-elevation/UAC-bypass path via dllhost.exe, enabling it to gain administrative privileges without triggering user-facing notifications or consent prompts.

ANY.RUN detects SolarisLoader fast, providing a response-ready report for SOC teams

• Active Malware-as-a-Service (MaaS) Cycle: The loader is in active development, functioning as a primary delivery vehicle for secondary payloads such as StealC, Amadey, and REMCOS RAT.

What is SolarisLoader?

SolarisLoader is a sophisticated Malware-as-a-Service (MaaS) delivery vehicle designed to dismantle a system's security infrastructure before deploying high-risk secondary payloads. First identified in early 2026, the malware is characterized by its aggressive approach to antivirus software: rather than merely attempting to hide, it actively seeks and destroys security processes from the kernel level. While it does not typically steal data itself, it creates a "blind spot" on the infected host, clearing the way for infamous stealers and loaders like Amadey.

The malware is primarily distributed through fake software installers bundled with cracked or pirated versions of popular applications and games. This distribution strategy exploits users who are already attempting to bypass legitimate software protocols, making them less likely to question the silent background installations or administrative requests that occur during the infection chain. In some instances, the loader will even drop and execute the legitimate cracked software after the infection is complete to further reduce user suspicion.

Technical analysis reveals that SolarisLoader is a highly professional product undergoing rapid evolution. Since its emergence, researchers have tracked its maturation from version 1.2.0 to 1.8.2, observing iterative refinements in its C2 communication protocols, anti-analysis techniques, and persistence mechanisms. Its core design prioritizes persistence and stealth; it utilizes a dedicated watchdog component (often recovered via PDB paths as "Solaris") that monitors the system and automatically re-initiates the malware implant if it is terminated or deleted. By combining kernel-level exploits with telemetry patching, SolarisLoader ensures that a compromised system's own security stack reports nothing unusual even as secondary payloads are actively executed.

How SolarisLoader Threatens Businesses and Organizations

For modern enterprises, SolarisLoader’s primary threat lies in its ability to create a "permanent blind spot" on an infected workstation, ensuring that subsequent malicious activities go entirely undetected by traditional monitoring tools.

Unlike most loaders that attempt to hide from security software, SolarisLoader uses a "Bring Your Own Vulnerable Driver" (BYOVD) technique to gain kernel-level access. By exploiting CVE-2026-0828 in the Safetica endpoint protection driver, the malware achieves the same system privileges as the security software itself, allowing it to forcibly terminate Windows Defender and major third-party antivirus processes like Avast, AVG, and 360 Total Security. The malware systematically "blinds" the operating system by patching the Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) directly in memory. This ensures that even if follow-on payloads execute suspicious scripts or file operations, the OS will not generate the event logs or telemetry needed for EDR (Endpoint Detection and Response) or SOC teams to flag the intrusion.

Victimology: Who Is Most Vulnerable?

The targeting profile of SolarisLoader is opportunistic and designed to exploit gaps in both technical controls and user behavior. While its distribution is global, specific technical markers reveal focused targeting strategies:

TI Lookup shows all the latest threat intel on Solaris Loader

• US and EU Companies: According to ANY.RUN’s [Threat Intelligence Lookup], the majority of Solaris Loader attacks affected businesses from the United States and the European Union.
• Organizations with Permissive Local Admin Rights: SolarisLoader relies on gaining administrative privileges to execute its most damaging stages, such as driver loading and hosts file modification. It utilizes a silent COM-elevation/UAC-bypass path via dllhost.exe, which means users running with local administrative rights can be compromised without ever seeing a permission prompt.
• Global Enterprise Users: The malware's targeting of global suites like Avast, AVG, and ReasonLabs makes it a universal threat. Any organization relying solely on signature-based antivirus or standard Windows telemetry (AMSI/ETW) is highly vulnerable, as SolarisLoader's telemetry-blinding and BYOVD techniques are specifically designed to defeat these common defenses.
• Secondary Infection Targets: Systems already compromised by other loaders, such as XTinyLoader or Amadey, are frequently targeted for SolarisLoader deployment, as it is often used as an intermediate stage to clear security hurdles before a final payload is delivered.

How Does SolarisLoader Function?

Detonating a SolarisLoader sample inside ANY.RUN’s Interactive Sandbox reveals a highly aggressive and multi-staged attack chain designed to neutralize system defenses before establishing a permanent foothold. By moving beyond simple file execution, the loader utilizes a series of strategic maneuvers to blind the operating system and deliver high-risk secondary payloads.

Stage 1: Initial Execution and Silent Elevation

The infection typically begins when the user executes a malicious installer, which runs from the user's Temp directory. Upon launch, the malware drops several staged components into the %TEMP% folder, including WinSysKdrv.exe, 0_1671390.exe, and 1_1675328.exe. SolarisLoader detonated inside ANY.RUN’s Interactive Sandbox

To gain the administrative privileges necessary for its subsequent stages without alerting the user, the loader spawns WinSysKdrv.exe through dllhost.exe (COM surrogate), a technique consistent with a silent COM-elevation/UAC-bypass path. Early in this execution phase, the sample creates the SOLARIS mutex, which acts as both an execution guard and an infection marker on the host to prevent multiple instances from running simultaneously.

SolarisLoader mutex detected by ANY.RUN’s Interactive Sandbox

Stage 2: Defense Dismantling and Network Isolation

Once elevated, SolarisLoader immediately begins systematically dismantling the endpoint's security stack. The sandbox analysis highlights several critical actions:

• Neutralizing Windows Defender: The malware disables real-time protection and modifies registry values associated with security policies and exclusion lists to prevent detection.

SolarisLoader disables MS Defender

• Kernel-Level Tampering: The loader creates or modifies Windows services specifically tied to kernel-driver loading. This allows the malware to achieve defense evasion by operating at the same privilege level as the operating system's core.
• Network Isolation: To prevent the machine from receiving updates or communicating with security telemetry servers, the malware rewrites the Windows hosts file. It redirects critical security and telemetry domains to unreachable local addresses, effectively isolating the host from external remediation.

Stage 3: Resilient Persistence and Watchdog Behavior

SolarisLoader injects itself into a legitimate process

SolarisLoader is engineered for maximum resilience against manual or automated cleanup. It ensures survival through two primary mechanisms:

• Process Injection: The malware injects malicious code into legitimate system processes, specifically RuntimeBroker.exe and sihost.exe. This acts as a watchdog, where these trusted system components monitor the infection and can re-initiate the malware if it is interrupted.
• Registry-Based Fallback: For long-term survival, it sets a login/logoff helper path in the registry as a fallback mechanism, ensuring the loader re-executes whenever a user logs into the system.

Logon-script persistence fallback via the registry

Stage 4: Host Reconnaissance (Fingerprinting)

Before contacting its command-and-control (C2) infrastructure, SolarisLoader performs a thorough reconnaissance of the infected workstation to create a unique host fingerprint.

Host fingerprinting: computer name, machine GUID, languages, install date, location

The sandbox observed the malware harvesting the following data points: Computer name and machine GUID, Windows installation date and system location settings, Supported system languages.

Stage 5: C2 Communication and Payload Delivery

The final stage of the attack involves establishing communication with the attacker's infrastructure to fulfill its role as a loader. The sample beacons to a specific C2 endpoint at 196[.]251[.]107[.]186/api.php.

SolarisLoader’s C2 beacon

Following this check-in, the loader was observed pulling additional malicious payloads, including bot_x64.exe and klr.exe, from a secondary IP address (192[.]162[.]199[.]186) that has been flagged as malicious. This confirms that SolarisLoader's ultimate goal is to serve as a delivery vehicle for further staged malicious activity.

How Businesses Can Use ANY.RUN’s Threat Intelligence Against Solaris

Because SolarisLoader operates as an evolving Malware-as-a-Service (MaaS) with infrastructure and file names that rotate rapidly, traditional static blocklists are often insufficient for long-term protection. Security teams must shift from tracking temporary indicators to identifying the durable technical fingerprints and behavioral patterns of the operation. By leveraging ANY.RUN’s Threat Intelligence, organizations can stay ahead of these evolving campaigns.

Threat Intelligence Lookup allows analysts to pivot from a single suspicious artifact to an entire cluster of related malicious activity.

threatName:"solaris"

Threat Intelligence Lookup provides actionable SolarisLoader indicators and TTPs

TI Lookup delivers a complete context on the threat, providing rich intelligence on SolarisLoader attacks, including network indicators, mutexes, file names, as well as full sandbox sessions that demonstrate the entire execution cycle from start to finish. For organizations requiring automated, high-speed protection, ANY.RUN’s Threat Intelligence Feeds provide a real-time stream of validated indicators. These feeds deliver a continuous flow of the latest C2 domains and malicious IPs directly into SIEM, SOAR, and EDR platforms. By integrating these feeds, teams can automatically block emerging malicious infrastructure, such as rotating fake-installer portals, and detect active breaches before data exfiltration occurs.

Conclusion

SolarisLoader represents a strategic shift in the cybercrime landscape, moving beyond simple evasion to the systematic neutralization of the entire security stack. By combining kernel-level exploits with telemetry blinding, the malware creates an environment where secondary payloads can operate with total visibility while the operating system remains unaware of the intrusion. To combat this evolving threat, organizations must move beyond static blocklists and reactive defenses, adopting a strategy that prioritizes behavioral analysis and proactive threat intelligence. Utilizing interactive sandboxing is essential to deobfuscate the loader's multi-stage logic and identify the durable technical signals, such as unauthorized driver loading and system-level telemetry tampering, before the successful delivery of high-risk secondary infections.

Frequently Asked Questions: SolarisLoader

1. What is SolarisLoader?

SolarisLoader is a specialized malware delivery vehicle designed to gain a persistent foothold on a host, disable its security tools, and deliver secondary infections like stealers and remote access trojans. It is sold on a subscription basis, allowing various threat actors to deploy it as a primary entry point for broader campaigns.

2. How does SolarisLoader bypass traditional security software?

The malware utilizes a "Bring Your Own Vulnerable Driver" (BYOVD) technique, exploiting a documented vulnerability in a legitimate third-party driver to achieve kernel-level privileges. This gives the loader the same system permissions as the security software it is attacking, allowing it to forcibly terminate security processes and endpoint detection services.

3. Why is a "clean" security scan result not trustworthy if this malware is present?

SolarisLoader specifically patches internal monitoring interfaces, such as the Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW), in memory. This "blinds" the system’s own telemetry, preventing it from logging or reporting malicious activity even if the security software remains active.

4. How can organizations use interactive sandboxing and threat intelligence to stay protected?

Interactive sandboxing is essential to expose the modular logic that evades automated scanners, allowing defenders to see how the malware escalates privileges and dismantles defenses in real-time. Proactive threat intelligence allows teams to identify stable build-chain fingerprints and block rotating C2 infrastructure before it reaches the endpoint.

5. What are the key indicators of a SolarisLoader infection?

Defenders should monitor for unauthorized redirects in the system hosts file (pointing security domains to unroutable addresses), the creation of scheduled tasks disguised as system security checks, and unauthorized additions to security exclusion lists. The presence of specific binary data in the system registry also serves as a backup for the malware's self-healing loop.