General

  • Target

    npp.8.4.8.Installer.x64.exe

  • Size

    4MB

  • Sample

    230118-f1ewcaac94

  • MD5

    c0a7843660c41c0da01a91298f426c03

  • SHA1

    e94077a65ba887fd97d8824245bfdbfa914b464e

  • SHA256

    6c365c86aa823b55235be2d7f139160bfe994a33b2d34b73de239b24bbde7391

  • SHA512

    c97c0712555476c8f0e0d39c5f52d36d8937c504f06f5ef5e9ec54fb98f3c61db910fefe5ab4c27d1c91c9c9e7688cd376b841c510090064fa563f412eeb91b9

  • SSDEEP

    49152:mj8saMWbZtUB8hSjRNTpGktKDJ3Ma1+Mf/bEA88pqhazt8JUtAl02F19NtvZk2:mosaxbZtJEj4rEAkJUcNdZr

Score
10/10

Malware Config

Extracted

Family

aurora

C2

79.137.133.225:8081

Targets

    • Target

      npp.8.4.8.Installer.x64.exe

    • Size

      4MB

    • MD5

      c0a7843660c41c0da01a91298f426c03

    • SHA1

      e94077a65ba887fd97d8824245bfdbfa914b464e

    • SHA256

      6c365c86aa823b55235be2d7f139160bfe994a33b2d34b73de239b24bbde7391

    • SHA512

      c97c0712555476c8f0e0d39c5f52d36d8937c504f06f5ef5e9ec54fb98f3c61db910fefe5ab4c27d1c91c9c9e7688cd376b841c510090064fa563f412eeb91b9

    • SSDEEP

      49152:mj8saMWbZtUB8hSjRNTpGktKDJ3Ma1+Mf/bEA88pqhazt8JUtAl02F19NtvZk2:mosaxbZtJEj4rEAkJUcNdZr

    Score
    7/10
    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Discovery

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                    Privilege Escalation

                      Tasks