General

  • Target

    SolаrQ ソララ.zip

  • Size

    11.9MB

  • MD5

    617d57874b6b40799d861450779954bf

  • SHA1

    70ee3e2dfd1ae700d193e1ded419aa25d9004f75

  • SHA256

    0517d8760ae58871d042179fbd554c8cd9a99b625e5f800bc2ac3f8d8592eede

  • SHA512

    ac5ba9be2ab0648fcb9efab17b7e622a6bf1ae1b940e4820d5eab4cecda5fe266159a2823d514964adc616d165cacbe267aee9b7db6afd7b4643fa6906a097f4

  • SSDEEP

    196608:2pdXu0anTurjamtNaWUg9aUIU7OVHi1/dyNMUxJw1KDtfZNNoPPD:kd3mTurjRYg9IOYHi1VeMUxJbBffqPb

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • SolаrQ ソララ.zip
    .zip

    Password: nK9MFMAB

  • SolаrQ ソララ/S o l a r a.exe
    .exe windows:4 windows x86 arch:x86

    Password: nK9MFMAB

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections

  • $INTERNET_CACHE/Accessing
  • $INTERNET_CACHE/Amber
  • $INTERNET_CACHE/Angola
  • $INTERNET_CACHE/Aurora
  • $INTERNET_CACHE/Carl
  • $INTERNET_CACHE/Clerk
  • $INTERNET_CACHE/Density
  • $INTERNET_CACHE/Disc
  • $INTERNET_CACHE/Dvds
  • $INTERNET_CACHE/Erik
  • $INTERNET_CACHE/Foods
  • $INTERNET_CACHE/Gratis
  • $INTERNET_CACHE/Hills
  • $INTERNET_CACHE/Hollow
  • $INTERNET_CACHE/Laid
  • $INTERNET_CACHE/Layers
  • $INTERNET_CACHE/Marine
  • $INTERNET_CACHE/Marks
  • $INTERNET_CACHE/Mono
  • $INTERNET_CACHE/Nuke
  • $INTERNET_CACHE/Parameters
  • $INTERNET_CACHE/Phase
  • $INTERNET_CACHE/Portal
  • $INTERNET_CACHE/Preserve
  • $INTERNET_CACHE/Property
  • $INTERNET_CACHE/Robot
  • $INTERNET_CACHE/Rocket
  • $INTERNET_CACHE/So
  • $INTERNET_CACHE/Stopping
  • $INTERNET_CACHE/Sucks
  • $INTERNET_CACHE/Tuition
  • $INTERNET_CACHE/Worldsex
  • SolаrQ ソララ/dll/VMProtectSDK32.dll
    .dll windows:5 windows x86 arch:x86

    Password: nK9MFMAB

    b9f19b4d3ce951c4ff6196681bbb3439


    Headers

    Imports

    Exports

    Sections

  • SolаrQ ソララ/dll/VMProtectSDK32.lib
  • SolаrQ ソララ/dll/autoexec/HOW_TO_USE.txt
  • SolаrQ ソララ/dll/celeryuwp.bin
    .dll windows:6 windows x86 arch:x86

    Password: nK9MFMAB

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections

  • SolаrQ ソララ/dll/celeryuwpver
  • SolаrQ ソララ/dll/uwpoff.bin
  • SolаrQ ソララ/dll/uwpoffver
  • SolаrQ ソララ/dll/uwpversion.txt
  • SolаrQ ソララ/scripts/scripts.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: nK9MFMAB

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections