Overview
overview
10Static
static
10solara/run...ra.bat
windows7-x64
3solara/run...ra.bat
windows10-2004-x64
3solara/run.bat
windows7-x64
1solara/run.bat
windows10-2004-x64
1solara/solara.dll
windows7-x64
3solara/solara.dll
windows10-2004-x64
10solara/solara fix.exe
windows7-x64
10solara/solara fix.exe
windows10-2004-x64
10General
-
Target
NyttWinRARarchive.rar
-
Size
3.4MB
-
Sample
241120-mbq1mswcnk
-
MD5
744cc4b75cfe42285183a9ee33f63d9c
-
SHA1
b7be8ebc31509711b39526934a62860e04f35775
-
SHA256
3ea702511247744377d079fb03dedb87411977028c82b0a9bbe699a80d9c895a
-
SHA512
e22aa544b02b9807896bd25423f773dcc0b5ecf9b413a1b35a4842eb34f98c0a95dbab64832d247027516a0fc6b4dca4d566464c5ebf0d2017c0ae86155d47f7
-
SSDEEP
98304:5FyzZFBks3UFSuof/iXuNNeDiiPW2jbU/7:ryl3k0USuof/ieLie2U/7
Behavioral task
behavioral1
Sample
solara/run to start solara.bat
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
solara/run to start solara.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
solara/run.bat
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
solara/run.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
solara/solara.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
solara/solara.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
solara/solara fix.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
solara/solara fix.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
sodinokibi
39
1332
wyreforest.net
clemenfoto.dk
centuryvisionglobal.com
ruggestar.ch
furland.ru
rechtenplicht.be
innovationgames-brabant.nl
acumenconsultingcompany.com
pedmanson.com
stressreliefadvice.com
lsngroupe.com
sshomme.com
tetameble.pl
optigas.com
skidpiping.de
hekecrm.com
corporacionrr.com
albcleaner.fr
ddmgen.com
katherinealy.com
hutchstyle.co.uk
interlinkone.com
vapiano.fr
marcandy.com
oro.ae
redctei.co
arabianmice.com
eafx.pro
campusce.com
perfectgrin.com
myplaywin3.com
prodentalblue.com
uci-france.fr
trivselsguide.dk
speakaudible.com
andrealuchesi.it
dmlcpa.com
nauticmarine.dk
nicksrock.com
glennverschueren.be
aberdeenartwalk.org
bluemarinefoundation.com
heimdalbygg.no
maryairbnb.wordpress.com
nginx.com
hartofurniture.com
premiumweb.com.ua:443
a-zpaperwork.eu
cl0nazepamblog.com
patriotcleaning.net
tilldeeke.de
bg.szczecin.pl
baptistdistinctives.org
geitoniatonaggelon.gr
ronielyn.com
oraweb.net
mrcar.nl
zorgboerderijravensbosch.nl
alattekniksipil.com
four-ways.com
kelsigordon.com
neolaiamedispa.com
proffteplo.com
concontactodirecto.com
xn--80addfr4ahr.dp.ua
stabilisateur.fr
hawaiisteelbuilding.com
sochi-okna23.ru
alisodentalcare.com
medicalsupportco.com
pro-gamer.pl
alharsunindo.com
michaelfiegel.com
jalkapuu.net
insane.agency
grafikstudio-visuell.de
tramadolhealth.com
bakingismyyoga.com
floweringsun.org
racefietsenblog.nl
evsynthacademy.org
suonenjoen.fi
transifer.fr
ygallerysalonsoho.com:443
pixelhealth.net
dnqa.co.uk
frameshift.it
texanscan.org
geoweb.software
cascinarosa33.it
prometeyagro.com.ua
khtrx.com
makingmillionaires.net
the-beauty-guides.com
bilius.dk
5thactors.com
111firstdelray.com
rattanwarehouse.co.uk
strauchs-wanderlust.info
cymru.futbol
morgansconsult.com
quitescorting.com
deziplan.ru
outstandingminialbums.com
kookooo.com
look.academy
schluesseldienste-hannover.de
juergenblaetz.de
eksperdanismanlik.com
hinotruckwreckers.com.au
ncn.nl
gardenpartner.pl
mahikuchen.com
fotoslubna.com
digitale-elite.de
glas-kuck.de
hiddensee-buhne11.de
catering.com
awag-blog.de
palmecophilippines.com
comoserescritor.com
sprintcoach.com
rapid5kloan.org
patassociation.com
sealgrinderpt.com
banksrl.co.za
tages-geldvergleich.de
renehartman.nl
metriplica.academy
cyberpromote.de
rs-danmark.dk
triplettabordeaux.fr
aslog.fr
frankgoll.com
latteswithleslie.com
fann.ru
weddingceremonieswithtim.com
malzomattalar.com
awaitspain.com
trainiumacademy.com
shortsalemap.com
bodymindchallenger.com
lassocrm.com
wribrazil.com
tellthebell.website
spacebel.be
initconf.com
tastevirginia.com
dcc-eu.com
descargandoprogramas.com
90nguyentuan.com
eyedoctordallas.com
noda.com.ua
pourlabretagne.bzh
baumfinancialservices.com
min-virksomhed.dk
c-sprop.com
mesajjongeren.nl
nykfdyrehospital.dk
fascaonline.com
yourcosmicbeing.com
animation-pro.co.uk
acornishstudio.co.uk
studionumerik.fr
mikegoodfellow.co.uk
drbenveniste.com
alcye.com
brunoimmobilier.com
housesofwa.com
agora-collectivites.com
jax-interim-and-projectmanagement.com
nexstagefinancial.com
nxtstg.org
julielusktherapy.com
jayfurnitureco.com
trevi-vl.ru
mediabolmong.com
photographycreativity.co.uk
rino-gmbh.com
watchsale.biz
wasnederland.nl
mindfuelers.com
kiraribeaute-nani.com
innervisions-id.com
hepishopping.com
amorbellezaysalud.com
fidelitytitleoregon.com
metroton.ru
napisat-pismo-gubernatoru.ru:443
pvandambv.nl
ciga-france.fr
citydogslife.com
naukaip.ru
premier-iowa.com
powershell.su
kvetymichalovce.sk
ahgarage.com
gratiocafeblog.wordpress.com
chatterchatterchatter.com
almamidwifery.com
rentsportsequip.com
campinglaforetdetesse.com
xrresources.com
xn--80abehgab4ak0ddz.xn--p1ai
ocduiblog.com
primemarineengineering.com
mundo-pieces-auto.fr
mediogiro.com.ar
jmmartinezilustrador.com
paradigmlandscape.com
jlwilsonbooks.com
mjk.digital
babysitting-hk.helpergo.co
cssp-mediation.org
angelika-schwarz.com
endstarvation.com
koncept-m.ru
ramirezprono.com
matthieupetel.fr
bodet150ans.com
thegrinningmanmusical.com
annenymus.com
pansionatblago.ru
hensleymarketing.com
ultimatelifesource.com
ownidentity.com
wordpress.idium.no
enews-qca.com
thehovecounsellingpractice.co.uk
5pointpt.com
akwaba-safaris.com
smartspeak.com
bumbipdeco.site
augen-praxisklinik-rostock.de
bulyginnikitav.000webhostapp.com
thisprettyhair.com
phukienbepthanhdat.com
dinedrinkdetroit.com
muni.pe
mike.matthies.de
ebible.co
tutvracks.com
n-newmedia.de
qwikcoach.com
liepertgrafikweb.at
cuadc.org
lmmont.sk
buzzneakers.com
go.labibini.ch
muller.nl
achetrabalhos.com
efficiencyconsulting.es
limmortelyouth.com
memphishealthandwellness.com
forextimes.ru
bayshoreelite.com
goodboyscustom.com
creohn.de
amco.net.au
akcadagofis.com
drnelsonpediatrics.com
boomerslivinglively.com
fbmagazine.ru
ikzoekgod.be
solidhosting.nl
energosbit-rp.ru
mariamalmahdi.com
graygreenbiomedservices.com
hostastay.com
condormobile.fr
p-ride.live
lattalvor.com
sjtpo.org
mayprogulka.ru
brighthillgroup.com
thesilkroadny.com
perceptdecor.com
cac2040.com
casinodepositors.com
welovecustomers.fr
penumbuhrambutkeiskei.com
lisa-poncon.fr
louiedager.com
hotjapaneselesbian.com
ceocenters.com
chomiksy.net
cardsandloyalty.com
alabamaroofingllc.com
parentsandkids.com
zuerich-umzug.ch
sppdstats.com
invela.dk
karelinjames.com
agendatwentytwenty.com
rename.kz
brisbaneosteopathic.com.au
loysonbryan.com
finnergo.eu
scentedlair.com
leopoldineroux.com
csaballoons.com
hawthornsretirement.co.uk
ninjaki.com
metallbau-hartmann.eu
thiagoperez.com
yournextshoes.com
hospitalitytrainingsolutions.co.uk
palmenhaus-erfurt.de
grancanariaregional.com
test-teleachat.fr
jefersonalessandro.com
vitoriaecoturismo.com.br
springfieldplumbermo.com
onlinetvgroup.com
lookandseen.com
letsstopsmoking.co.uk
thenalpa.com
turing.academy
campusescalade.com
crestgood.com
sbit.ag
bundan.com
haus-landliebe.de
berdonllp.com
alwaysdc.com
ijsselbeton.nl
jobkiwi.com.ng
pubcon.com
livedeveloper.com
stitch-n-bitch.com
encounter-p.net
chainofhopeeurope.eu
justaroundthecornerpetsit.com
curtsdiscountguns.com
gavelmasters.com
saint-malo-developpement.fr
breathebettertolivebetter.com
piestar.com
molade.nl
avtoboss163.ru:443
skoczynski.eu
professionetata.com
michal-s.co.il
edvestors.org
bratek-immobilien.de
eventosvirtualesexitosos.com
selected-minds.de
smartworkplaza.com
artvark.nl
deduktia.fi
dennisverschuur.com
kickittickets.com
leansupremegarcinia.net
elliemaccreative.wordpress.com
satoblog.org
ludoil.it
jag.me
ivancacu.com
vipcarrental.ae
onlinemarketingsurgery.co.uk
electricianul.com
alexwenzel.de
voice2biz.com
grupoexin10.com
cc-experts.de
ingresosextras.online
m2graph.fr
aquacheck.co.za
atma.nl
mazzaropi.com.br
johnsonweekly.com
xn--billigafrgpatroner-stb.se
sycamoregreenapts.com
marmarabasin.com
hoteltantra.com
billscars.net
davedavisphotos.com
futurenetworking.com
mgimalta.com
internalresults.com
alpesiberie.com
circlecitydj.com
rarefoods.ro
rtc24.com
site.markkit.com.br
liveyourheartout.co
annida.it
irizar.com
zumrutkuyutemel.com
skyboundnutrition.co.uk
raeoflightmusic.com
shrinkingplanet.com
indiebizadvocates.org
afbudsrejserallinclusive.dk
the5thquestion.com
epicjapanart.com
flossmoordental.com
burg-zelem.de
zealcon.ae
eurethicsport.eu
jaaphoekzema.nl
kristianboennelykke.dk
ya-elka.ru
dentourage.com
dieetuniversiteit.nl
utilisacteur.fr
stathmoulis.gr
nepressurecleaning.com
singletonfinancial.com
startuplive.org
groovedealers.ru
randyabrown.com
parseport.com
carsten.sparen-it.de
mustangmarketinggroup.com
fskhjalmar.se
fridakids.com
rokthetalk.com
domaine-des-pothiers.com
lashandbrowenvy.com
lexced.com
worldproskitour.com
queertube.net
skinkeeper.li
sunsolutions.es
palema.gr
devplus.be
epsondriversforwindows.com
operativadigital.com
2020hindsight.info
eos-horlogerie.com
finsahome.co.uk
golfclublandgoednieuwkerk.nl
bridalcave.com
nevadaruralhousingstudies.org
richardmaybury.co.uk
auberives-sur-vareze.fr
zinnystar.com
claudiakilian.de
envomask.com
parisschool.ru
astrographic.com
successcolony.com.ng
santastoy.store
aciscomputers.com
buonabitare.com
dr-vita.de
smartercashsystem.com
janellrardon.com
cp-bap.de
b3b.ch
yvesdoin-aquarelles.fr
dinecorp.com
towelroot.co
andermattswisswatches.ch
testitjavertailut.net
ykobbqchicken.ca
theboardroomafrica.com
mediahub.co.nz
cmascd.com
globalskills.pt
gatlinburgcottage.com
plbinsurance.com
sachainchiuk.com
putzen-reinigen.com
cleanroomequipment.ie
factorywizuk.com
baikalflot.ru
boloria.de
cops4causes.org
angeleyezstripclub.com
radishallgood.com
espaciopolitica.com
forumsittard.nl
leijstrom.com
laylavalentine.com
gurutechnologies.net
janmorgenstern.com
vdolg24.online
boyfriendsgoal.site
biketruck.de
die-immo-agentur.de
bluelakevision.com
iexpert99.com
itheroes.dk
tbalp.co.uk
3daywebs.com
mindsparkescape.com
motocrosshideout.com
reizenmetkinderen.be
imagine-entertainment.com
catalyseurdetransformation.com
broccolisoep.nl
legundschiess.de
hm-com.com
drvoip.com
shortysspices.com
kroophold-sjaelland.dk
moira-cristescu.com
global-migrate.com
jeanmonti.com
teutoradio.de
linearete.com
entdoctor-durban.com
schlagbohrmaschinetests.com
slotenmakerszwijndrecht.nl
smartmind.net
olry-cloisons.fr
rozmata.com
soncini.ch
cotton-avenue.co.il
9nar.com
secrets-clubs.co.uk
arearugcleaningnyc.com
alnectus.com
victorvictoria.com
profibersan.com
so-sage.fr
spirello.nl
kryddersnapsen.dk
cxcompany.com
enactusnhlstenden.com
the-cupboard.co.uk
tecleados.com
unislaw-narty.pl
collegetennis.info
maxcube24.com.ua
devus.de
webforsites.com
hypogenforensic.com
krishnabrawijaya.com
valiant-voice.com
nepal-pictures.com
jameswilliamspainting.com
mangimirossana.it
apiarista.de
expohomes.com
kenmccallum.com
oportowebdesign.com
vedsegaard.dk
traitware.com
alene.co
paprikapod.com
tanatek.com
reygroup.pt
diakonie-weitramsdorf-sesslach.de
web865.com
jglconsultancy.com
molinum.pt
newonestop.com
amelielecompte.wordpress.com
catchup-mag.com
anleggsregisteret.no
funworx.de
slotspinner.com
thepixelfairy.com
happylublog.wordpress.com
suitesartemis.gr
manzel.tn
azloans.com
biodentify.ai
heuvelland-oaze.nl
amyandzac.com
tatyanakopieva.ru
o2o-academy.com
salonlamar.nl
slideevents.be
ziliak.com
subquercy.fr
beauty-traveller.com
sololibrerie.it
subyard.com
stagefxinc.com
holocine.de
donau-guides.eu
greeneyetattoo.com
modamarfil.com
bjornvanvulpen.nl
directique.com
mbuildinghomes.com
fotoeditores.com
yayasanprimaunggul.org
rolleepollee.com
paardcentraal.nl
lovcase.com
luvbec.com
belinda.af
livelai.com
miscbo.it
imaginekithomes.co.nz
humanviruses.org
galatee-couture.com
ced-elec.com
keyboardjournal.com
matteoruzzaofficial.com
wirmuessenreden.com
precisetemp.com
saberconcrete.com
speiserei-hannover.de
frimec-international.es
rossomattonecase.it
wineandgo.hu
istantidigitali.com
dogsunlimitedguide.com
elex.is
docarefoundation.org
riffenmattgarage.ch
kellengatton.com
cmeow.com
agenceassemble.fr
rvside.com
ketomealprep.academy
mslp.org
soundseeing.net
fanuli.com.au
block-optic.com
buerocenter-butzbach-werbemittel.de
advesa.com
scholarquotes.com
hostingbangladesh.net
jonnyhooley.com
fsbforsale.com
wallflowersandrakes.com
nvisionsigns.com
pokemonturkiye.com
scotlandsroute66.co.uk
nutriwell.com.sg
lyricalduniya.com
thestudio.academy
andreaskildegaard.dk
spectamarketingdigital.com.br
goddardleadership.org
licensed-public-adjuster.com
gazelle-du-web.com
jacquesgarcianoto.com
awaisghauri.com
fysiotherapierijnmond.nl
billyoart.com
abulanov.com
gbk-tp1.de
richardkershawwines.co.za
altocontatto.net
qandmmusiccenter.com
easydental.ae
chorusconsulting.net
sharonalbrightdds.com
skyscanner.ro
altitudeboise.com
mamajenedesigns.com
lesyeuxbleus.net
supercarhire.co.uk
tradenavigator.ch
etgdogz.de
zaczytana.com
chinowarehousespace.com
pazarspor.org.tr
promus.ca
mondolandscapes.com
liverpoolabudhabi.ae
wg-heiligenstadt.de
jlgraphisme.fr
poems-for-the-soul.ch
agencewho-aixenprovence.fr
unexplored.gr
cainlaw-okc.com
ilovefullcircle.com
mieleshopping.it
k-v-f.de
guohedd.com
brownswoodblog.com
lidkopingsnytt.nu
jakubrybak.com
aheadloftladders.co.uk
whoopingcrane.com
johnstonmingmanning.com
acibademmobil.com.tr
mazift.dk
mneti.ru
witraz.pl
citiscapes-art.com
cesep2019.com
designimage.ae
kdbrh.com
aidanpublishing.co.uk
universelle.fr
stringnosis.academy
breakluckrecords.com
belofloripa.be
projektparkiet.pl
hameghlim.com
schulz-moelln.de
bringmehope.org
wademurray.com
letterscan.de
leadforensics.com
verbouwingsdouche.nl
duthler.nl
arthakapitalforvaltning.dk
nrgvalue.com
ideamode.com
jobscore.com
terraflair.de
adterium.com
peppergreenfarmcatering.com.au
mariannelemenestrel.com
jandhpest.com
levelseven.be
delegationhub.com
animalfood-online.de
activeterroristwarningcompany.com
der-stempelking.de
martha-frets-ceramics.nl
theintellect.edu.pk
toranjtuition.org
narca.net
ayudaespiritualtamara.com
kamin-somnium.de
bmw-i-pure-impulse.com
forskolinslimeffect.net
bourchier.org
mursall.de
orchardbrickwork.com
cookinn.nl
carmel-york.com
sarahspics.co.uk
fta-media.com
werkzeugtrolley.net
affligemsehondenschool.be
1deals.com
limounie.com
cap29010.it
keuken-prijs.nl
oncarrot.com
azerbaycanas.com
ntinasfiloxenia.gr
oscommunity.de
laaisterplakky.nl
rsidesigns.com
zdrowieszczecin.pl
bubbalucious.com
saboboxtel.uk
thegetawaycollective.com
advanced-removals.co.uk
mollymccarthydesign.com
dayenne-styling.nl
acb-gruppe.ch
baita.ac
jimprattmediations.com
denhaagfoodie.nl
dentalcircle.com
stage-infirmier.fr
ox-home.com
phoenixcrane.com
ilveshistoria.com
peninggibadan.co.id
rentingwell.com
omnicademy.com
nuohous.com
ronaldhendriks.nl
globalcompliancenews.com
billigeflybilletter.dk
druktemakersheerenveen.nl
spartamovers.com
gosouldeep.com
dentallabor-luenen.de
egpu.fr
janasfokus.com
lovetzuchia.com
sellthewrightway.com
signededenroth.dk
rubyaudiology.com
lollachiro.com
gsconcretecoatings.com
distrifresh.com
anchelor.com
rishigangoly.com
adaduga.info
theater-lueneburg.de
focuskontur.com
kompresory-opravy.com
blueridgeheritage.com
christianscholz.de
bluetenreich-brilon.de
sytzedevries.com
k-zubki.ru
silkeight.com
buffdaddyblog.com
g2mediainc.com
fla.se
levencovka.ru
mrmac.com
tchernia-conseil.fr
malevannye.ru
yuanshenghotel.com
switch-made.com
latableacrepes-meaux.fr
sveneulberg.de
sambaglow.com
atelierkomon.com
vvego.com
betterce.com
opticahubertruiz.com
adedesign.com
xn--ziinoapte-6ld.ro
pilotgreen.com
pays-saint-flour.fr
bohrlochversicherung.info
clinic-beethovenstrasse-ag.ch
landgoedspica.nl
bellesiniacademy.org
blavait.fr
airserviceunlimited.com
mensemetgesigte.co.za
11.in.ua
nalliasmali.net
bendel-partner.de
fire-space.com
biblica.com
line-x.co.uk
iron-mine.ru
business-basic.de
loparnille.se
specialtyhomeservicesllc.com
advancedeyecare.com
aceroprime.com
alltagsrassismus-entknoten.de
bonitabeachassociation.com
kartuindonesia.com
opt4cdi.com
pinkxgayvideoawards.com
polynine.com
craftingalegacy.com
agriturismocastagneto.it
diverfiestas.com.es
theatre-embellie.fr
otpusk.zp.ua
auto-opel.ro
drbrianhweeks.com
nationnewsroom.com
triplettagaite.fr
inewsstar.com
netadultere.fr
pajagus.fr
harleystreetspineclinic.com
dantreranch.com
sber-biznes.com
motocrossplace.co.uk
yourhappyevents.fr
uncensoredhentaigif.com
omegamarbella.com
asiaartgallery.jp
internestdigital.com
teethinadaydentalimplants.com
goodherbalhealth.com
eshop.design
edrickennedymacfoy.com
veggienessa.com
charlesfrancis.photos
pureelements.nl
skooppi.fi
avisioninthedesert.com
bruut.online
kausette.com
dierenambulancealkmaar.nl
hvitfeldt.dk
goeppinger-teppichreinigung.de
basindentistry.com
midwestschool.org
triavlete.com
leatherjees.com
husetsanitas.dk
reputation-medical.online
computer-place.de
autoteamlast.de
framemyballs.com
tieronechic.com
relevantonline.eu
hnkns.com
axisoflove.org:443
metcalfe.ca
coachpreneuracademy.com
bajova.sk
birthplacemag.com
domilivefurniture.com
monstarrsoccer.com
lapponiasafaris.com
purepreprod4.com
gaearoyals.com
aoyama.ac
ufovidmag.com
allinonecampaign.com
fluzfluzrewards.com
brinkdoepke.eu
georgemuncey.com
fitnessblenderstory.com
rhino-storage.co.uk
johnkoen.com
schroederschoembs.com
bavovrienden.nl
chris-anne.com
larchwoodmarketing.com
haard-totaal.nl
ncjc.ca
artcase.pl
kryptos72.com
elitkeramika-shop.com.ua
oexebusiness.com
nbva.co.uk
production-stills.co.uk
bescomedical.de
cincinnatiphotocompany.org
dibli.store
rizplakatjaya.com
endlessrealms.net
denverwynkoopdentist.com
mercadodelrio.com
fi-institutionalfunds.com
protoplay.ca
dreamvoiceclub.org
leloupblanc.gr
mac-computer-support-hamburg.de
walterman.es
natturestaurante.com.br
avis.mantova.it
tweedekansenloket.nl
sweetz.fr
lumturo.academy
unboxtherapy.site
advance-refle.com
simpleitsolutions.ch
customroasts.com
girlish.ae
placermonticello.com
christopherhannan.com
benchbiz.com
klapanvent.ru
stanleyqualitysystems.com
renderbox.ch
kuriero.pro
mariajosediazdemera.com
zwemofficial.nl
agrifarm.dk
hotelturbo.de
airvapourbarrier.com
xtensifi.com
margaretmcshane.com
askstaffing.com
magrinya.net
magnetvisual.com
linkbuilding.life
alaskaremote.com
logosindustries.com
lagschools.ng
teamsegeln.ch
bychowo.pl
skolaprome.eu
topautoinsurers.net
pxsrl.it
rhino-turf.com
from02pro.com
kombi-dress.com
stralsund-ansichten.de
physio-lang.de
eastgrinsteadwingchun.com
banukumbak.com
arazi.eus
lifeinbreaths.com
voetbalhoogeveen.nl
oththukaruva.com
angelsmirrorus.com
craftstone.co.nz
lunoluno.com
photonag.com
imajyuku-sozoku.com
pankiss.ru
jobstomoveamerica.org
ikadomus.com
the3-week-diet.net
tzn.nu
galaniuklaw.com
apogeeconseils.fr
bertbutter.nl
o90.dk
nourella.com
qrs-international.com
parksideseniorliving.net
apmollerpension.com
bcabattoirs.org
bookingwheel.com
explora.nl
kafkacare.com
beandrivingschool.com.au
smarttourism.academy
direitapernambuco.com
foerderverein-vatterschule.de
handyman-silkeborg.dk
hostaletdelsindians.es
stoneridgemontessori.com
craftron.com
barbaramcfadyenjewelry.com
circuit-diagramz.com
factoriareloj.com
myfbateam.com
kemtron.fr
fixx-repair.com
richardiv.com
kerstliedjeszingen.nl
cormanmarketing.com
eatyoveges.com
therapybusinessacademy.com
carolynfriedlander.com
masecologicos.com
bagaholics.in
datatri.be
tesisatonarim.com
colored-shelves.com
aktivfriskcenter.se
t3brothers.com
glende-pflanzenparadies.de
lgiwines.com
adabible.org
daveystownhouse.com
hom-frisor.dk
techybash.com
karmeliterviertel.com
signamedia.de
wrinstitute.org
publicompserver.de
martinipstudios.com
onesynergyinternational.com
silverbird.dk
iactechnologies.net
jdscenter.com
innersurrection.com
markseymourphotography.co.uk
osn.ro
pisofare.co
blucamp.com
mrkluttz.com
ravage-webzine.nl
scietech.academy
charlottelhanna.com
antesacademy.it
pinthelook.com
nieuwsindeklas.be
brannbornfastigheter.se
neonodi.be
log-barn.co.uk
happycatering.de
tothebackofthemoon.com
solutionshosting.co.uk
vitormmcosta.com
rivermusic.nl
topvijesti.net
littlesaints.academy
volta.plus
bcmets.info
atrgroup.it
taulunkartano.fi
greatofficespaces.net
mind2muscle.nl
fazagostar.co
jollity.hu
greenrider.nl
chatberlin.de
ledyoucan.com
bd2fly.com
kosten-vochtbestrijding.be
pharmeko-group.com
profiz.com
gta-jjb.fr
redpebblephotography.com
luvinsburger.fr
-
net
true
-
pid
39
-
prc
sql
dbsnmp
mydesktopqos
ocautoupds
firefox
msaccess
sqbcoreservice
synctime
tbirdconfig
xfssvccon
infopath
powerpnt
excel
visio
encsvc
ocssd
onenote
isqlplussvc
mspub
wordpa
agntsvc
steam
thunderbird
thebat
ocomm
winword
oracle
outlook
dbeng50
mydesktopservice
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1332
-
svc
svc$
sql
veeam
sophos
memtas
mepocs
backup
vss
Extracted
C:\Users\8elklm5045-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3A594AD85B7E99DF
http://decryptor.top/3A594AD85B7E99DF
Extracted
C:\Users\Admin\Documents\@[email protected]
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Targets
-
-
Target
solara/run to start solara.bat
-
Size
34B
-
MD5
bfe118783da9a4345f1fbc98dfc685a0
-
SHA1
569fc8c34b23e123f6dc981d21649ea9990d9897
-
SHA256
d2872e7391c3ae2f491d0572df127b1b0a758ea083df053cd200b620fa29228d
-
SHA512
44fafd5f7e04dc330490fee24ac1c95902a47e8073805e136ae6cd2bedf489580868be35e66231a31f5ca360b929bc32b74757784a394333aed682208657474b
Score3/10 -
-
-
Target
solara/run.bat
-
Size
30B
-
MD5
686c29811daada9c939d623efb1bb018
-
SHA1
cb7856ef0b4811e15c50d864219b008f8a6587ca
-
SHA256
d485c7f27a245b45218bb966ba175dbbbd809590b90dc4feb1c4fdd298ad33e5
-
SHA512
14655cbc551857c659c5da600c5ff6f7b988aa4fbc4da04a9d6481cc139e3751473f61995f1ded7f44c8c7297c6d6a7fa0aeb69b55f7963990fe663889ef5500
Score1/10 -
-
-
Target
solara/solara
-
Size
164KB
-
MD5
6e3efb83299d800edf1624ecbc0665e7
-
SHA1
0bd22f204c5373f1a22d9a02c59f69f354a2cc0d
-
SHA256
2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6
-
SHA512
dd1675bb15eb8ea2933b25413271117823ad7ff38280e7f552b5201e3a5bef8607a2112df2e24f598449ebfdb570ff9458aba0314ed8819dd4d774ea855e9ad2
-
SSDEEP
3072:FWeI5JXJRGpUhFiWjmfb+HP+rnRfU9ECs5p:FWe29/GuzjmfCHWtUiCs5p
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
-
-
Target
solara/solara fix.exe
-
Size
3.4MB
-
MD5
84c82835a5d21bbcf75a61706d8ab549
-
SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
-
SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
SSDEEP
98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
-
Wannacry family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1