add4fece7d3413c41569cece108ee1657a0652cff18df174d90a7eea3c674d30

Sharing

Copy URL Twitter E-mail

General

Target
Solara.Dir (1).zip
Size 12.2MB
Sample260715-vmze6ac16w
SHA256 add4fece7d3413c41569cece108ee1657a0652cff18df174d90a7eea3c674d30
MD5 14746ec626caf2c979e63268897f7336
SHA1 38feda199ce506af6e933b90c9eba463077a01b7
SHA512 ddf8aedb607c15f5a46c9ec551251f9e331a5588d03c9dd6823b250d2678e50997fbe1354bd8dfbb171fd3cd3615b3eb618aa08bb7ccad3c44ea8bb7c45cda78
SSDEEP 393216:vURyKOQfeLVgm/EkT0Uq4g2UXbEds1uTmnyS6J0t:cDpeZpTQ4g3XbEEDnySw0t
TLSH
T1ADD63367D1F82612CFDBF17B798BCF1D78A6A6CE0050A80029DC63463A570D45ABE1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Solara.Dir (1).zip
- Size 12.2MB
- SHA256 add4fece7d3413c41569cece108ee1657a0652cff18df174d90a7eea3c674d30
- MD5 14746ec626caf2c979e63268897f7336
- SHA1 38feda199ce506af6e933b90c9eba463077a01b7
- SHA512 ddf8aedb607c15f5a46c9ec551251f9e331a5588d03c9dd6823b250d2678e50997fbe1354bd8dfbb171fd3cd3615b3eb618aa08bb7ccad3c44ea8bb7c45cda78
- SSDEEP 393216:vURyKOQfeLVgm/EkT0Uq4g2UXbEds1uTmnyS6J0t:cDpeZpTQ4g3XbEEDnySw0t
- TLSH
  T1ADD63367D1F82612CFDBF17B798BCF1D78A6A6CE0050A80029DC63463A570D45ABE1ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Solara/Monaco/fileaccess/node_modules/accepts/package.json
- Size 1KB
- SHA256 e5716d5d939db08c5c28ec6ae86ed67be5320f91089e2673fca1c5b876e57aa3
- MD5 32a15d6909fcae63e52d8664593d32d5
- SHA1 131ba4d63747e6663a9c19409e43ac034bd532cf
- SHA512 6f0e9fe3d034640b8b2f902a5e336b39d818cec504a9c52767f5f08d71bb1903b182771625c110f768a8cc540b071a54afb7810270a09f4edfe5e35dba22fe37
- TLSH
  T15821DD21C58A0CA312D9A6F5786D22C3206248478956FD2DF7B9130D4F8DABF90F66FC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Solara/Monaco/fileaccess/node_modules/array-flatten/package.json
- Size 879B
- SHA256 5c5e0e10cfa23f163d1fe68aa57a881d09cac39d720e1361c697b86c4d33e0f5
- MD5 cb1aa7f817100a03395dd0163bf6ebe9
- SHA1 fc51b89d0fb7cc640a0495baa4005364e83718c3
- SHA512 81ffee7b54b11b42aaeeaf1b6fb13ac64e8900e94ffd249fe075c183c3adf8e8451529d82f6a13216c73e5d1a1f57d703d9fcf1e61674020d93b15066d37dc75
- TLSH
  T1E31148A8E8705CB70DEA6DA45C780182E2101C878C07FD89B79F8B2C4F1D46710FA59F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Solara/Monaco/fileaccess/node_modules/body-parser/package.json
- Size 1KB
- SHA256 0fd31ad69fdcf1e2a94530f9db9c93e96709b690393a14711643123f678ee956
- MD5 826bd4315438573ba1a6d88ae2a2aa65
- SHA1 3e27986a947e7d10488739c9afb75f96b646c4c5
- SHA512 2e98ba8e57cb0950e45d20365d16e86ad94a60cfd4cf103b7d55dae02de677985d37c0f771e16ae0a628cb3b59adce8a9e1742cffc298f18cb7d935d72536e6d
- TLSH
  T16631F120C4C91DB362D4A5ED7C6921C22040444B8E82FD0DF765035C8F8E6EFA17AAFD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Solara/Monaco/fileaccess/node_modules/bytes/package.json
- Size 959B
- SHA256 99b21c09ce812dc76a06cd87c4753247cb9615c6a8501c5a5a9d9caa22ea2d12
- MD5 5e3137feec27c5d88693e0cb2ff95d3c
- SHA1 d8fe3e70eb4ecf4bf58385e4b27f89b7ce656a28
- SHA512 4b4d89317e1a1caae6924f234b75e15bd2f8bd026d316152e6cf3ffac53553bea2995076a8a365f26a96730f36170d115ac35aae6d0888f621f536d795b89a2d
- TLSH
  T16A119030C9984C6313CE96613C656182B11288474994BE0DBBED131D0F5F6AF90FF76D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery motw persistence phishing ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral10 behavioral9
- Target
  Solara/Monaco/fileaccess/node_modules/call-bind/package.json
- Size 2KB
- SHA256 e8fc7600526cc041bfcd3a562e6cfdb53952a7f7fb4fcc899949e4c51c586155
- MD5 7327c5e04c116460b3c73ee92292269a
- SHA1 106489d54a0669a5271c89f87f2072cfb8e66c4f
- SHA512 93f2327154e59b1f6fa2f55659fd5a8bae1da6cb4dc2ea5ef736ed6abbcbb2840286be9346bea22a3dd52371ac842870bd388dcc1e5b673696bc0cad868422d8
- TLSH
  T126411127DB2DC9B706C42F7C6A6E60D2E5BAC0514956CCCE8EB17B16809C171226FD45
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Solara/Monaco/fileaccess/node_modules/content-disposition/package.json
- Size 1KB
- SHA256 2459c0e8fbeb5716ab06e9ef73747bba46ed2bc52e310bd4e9f0ef1f102da61f
- MD5 5b285d4db057e7e72225e8e928d2ffa3
- SHA1 1b871ffaefe2a1fd69aa9b1538b4003bf0eae9ab
- SHA512 dfe71ab6bcf40f32a26273a94f11439cbe3066bc3216061ee6ea9737d57b1cabf03a0e45b2fc50c4d0097a27e09197c7fd2b60090a91876671d2c709f31a29a4
- TLSH
  T17621BE20D4555C6342D4A3AAB96951C27065084B4D16BD0CFB6E125C8FCD2BBA0FBFFC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Solara/Monaco/fileaccess/node_modules/content-type/package.json
- Size 1KB
- SHA256 bd78a5427ffca1966621301edc6cac2146c8c1e137f122161ba90dca7ec89f77
- MD5 0de0482c40698c075e13e4d54ff34466
- SHA1 1545c6d8538d7e59f375d4ae4b0e0d10471a6c1c
- SHA512 9f32408067afa748af8d23b4bbbe2657e566017435d4ead1e63b6d12f8bebb671ea82353a302340bb6f1ccd4852a3cb8ed340a3a8af9cd058bd36653b3cd4bcb
- TLSH
  T1D811AF20C9854C7352D49AB9B91471C2656144478A43FD0DF7B5022C8FCE2AF90FA6EC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Solara/Monaco/fileaccess/node_modules/cookie-signature/package.json
- Size 492B
- SHA256 ab66777a673ae096d6b5aa51b5edb46b84e6fcd85dc03358c35576e3df0464f5
- MD5 076c53814237236a9d1aa999f33ee501
- SHA1 eb071423205fc35573e714baa755e3a9e900a979
- SHA512 d5feee2e6c8af31560a3141ebe4254ce66972da9b9e3463eafcea214f49131e325136503de3f0fa76b454f63ebfdbf5d599caf558978aaca5a1656c2c7c8eec1
- TLSH
  T18BF09E15D979683706DC2395ACB41047B7271C8F00D4BC0C278B522C538E1AB07FD53E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Solara/Monaco/fileaccess/node_modules/cookie/package.json
- Size 1KB
- SHA256 e740b0e5656b2029fb858bc93b10312dff16374283a2ecd9caa90848190dff88
- MD5 d55aa6bd2733ca1031186952d1485f43
- SHA1 dd82a1cea772234696f0489aecacfe9aa8ff943e
- SHA512 e4324126170c2a6d4e01f7bd8774a26babc5abff86692f283bf691e2b435f6b6f2823179e080aabde20d368bb26707a726d54c8d64e7838e215cef074c499598
- TLSH
  T12C211230D8694C7311D927A138159882B62209475F40BC0DBBFA122D4FDE5BF65FA6BD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Solara/Monaco/fileaccess/node_modules/debug/package.json
- Size 1KB
- SHA256 6c3d2c892db282317913ce7c340dd2edccd326bcafd18b644b8738144967d6ee
- MD5 71a7656944ffe50cc27ebe02491ae49b
- SHA1 8ebf0f80660d982fc68f00f82855696157e74b10
- SHA512 5b0010b41304e212a22d2c89eff65ce410b000c71c4ab8c7fdba8f549ba0629fe27f37c142058b041fb889bc73e00959ad58f673866ee7d29724687da3c3f320
- TLSH
  T1D8219560DD58DCA34AC515A46C6D5043736158478E84FC0E379B078C8F5E46F26FCA2D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Solara/Monaco/fileaccess/node_modules/define-data-property/package.json
- Size 2KB
- SHA256 bde7f1465b344a24da2b10d2ee99f87edf8e0ecd177c28370b60ad9595de730e
- MD5 05b9ba4536b59b74c4b3c95327787004
- SHA1 c9384aa894159ee96e107cdd3002915849fc91fc
- SHA512 4b81bbd31fd5ddce528fb0ebcefbbda77891f124f7fab9019c5ff1bddddafbb679b5e3d131a94c02b495e47327985fa5ecc613f7a2a109e58f5994b358fc3b0e
- TLSH
  T116511423EF6CC9B30EC056AC693DA4D2F27A84154974DCCEDFA17B66C05C0B5322AA47
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Solara/Monaco/fileaccess/node_modules/depd/package.json
- Size 1KB
- SHA256 5a3659bcc2e47b25ebf9f23f38eb9452a58920bfe4b59410bfa6fe84639a3b99
- MD5 7f0a9d228c79f0ee4b89fc6117f1c687
- SHA1 3c10082c1464a6f589aa10cda88285e780ebf857
- SHA512 7bdd7259bcb8d79aa41777f03d3a3f8a29b60c2d25104072edba9febeb813e12ef78d31573637702decddbaa97d8fec263bc413bd27dd660ded17d644458cbc2
- TLSH
  T13B21FD20D4680CA35AC8499478A89AC1359105474E52BC0DF72E135D8F8E5BFE0FEABC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Solara/Monaco/fileaccess/node_modules/destroy/package.json
- Size 1KB
- SHA256 f865b50652dc062f43142e01f55db2760cc10d255bd05afd232e738999c58188
- MD5 6015f23c6e2fd79f4a6e29453ce4dc1d
- SHA1 e12115ed9a1e2c56eb35ecfc14ff83b8c02935d5
- SHA512 1a09253a53e4067abb67e51d3efc6483da2984581bb1583805da63a602b525e9b5055b78eedd42e823bda8fcbcd92a69b1d89f72de5e3d867524476c05552ea2
- TLSH
  T106218065C4650CA326D495E9682452C3706144874D42BD1EF7BD031C4F4F9BFA1B56EC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Solara/Monaco/fileaccess/node_modules/ee-first/package.json
- Size 859B
- SHA256 a4eece6ff6b38bf7ac107323f381cc60500097a9cbdd473f5d5b45e68822cb89
- MD5 3ed21090e07ef5dd57729a77c4291cb9
- SHA1 7ffe61f87f94a558fabc177cad5c9b90b16481cf
- SHA512 54de61c6ab428104f9a559ecd3df7868ab7f1b5c8b85a3f658c8dab13d435bd0766c6b48178a1d5bd083b0829f6461158e303538c7d08761b201b17f7c9940b3
- TLSH
  T1A111C262D8355D631AC452B07C7580827699449F4A28BD1EB74E071C5F0D476E0BB75D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Solara/Monaco/fileaccess/node_modules/encodeurl/package.json
- Size 1KB
- SHA256 30b1a43843675f42033fd6c77c19b20ad4344844f0bd5526c586081e93a48fe8
- MD5 453a9bb10c91e0ec44f305b14e30ce82
- SHA1 73c01b81f34a9978b158df2744ef8c45251d6193
- SHA512 d81ee5f2394493a5f93918ecae6581f82ee529fbbd257e0dc10ea68f09c39d0d19e3a6b0e9560eb1250d88a9b1f591d6469f28404410b16b580cbe179e37da0f
- TLSH
  T10211EF21D8AE1C1329D492A6B96542C1119D048B4E16BD0CFB6E136C4F4E17B50FBAFD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Mark of the Web detected: This indicates that the page was originally saved or cloned.

Network Share Discovery

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32