Overview

overview

10

Static

static

10

npp.8.4.8....64.exe

windows7-x64

7

npp.8.4.8....64.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    npp.8.4.8.Installer.x64.exe

  • Size

    4.4MB

  • Sample

    230118-f1ewcaac94

  • MD5

    c0a7843660c41c0da01a91298f426c03

  • SHA1

    e94077a65ba887fd97d8824245bfdbfa914b464e

  • SHA256

    6c365c86aa823b55235be2d7f139160bfe994a33b2d34b73de239b24bbde7391

  • SHA512

    c97c0712555476c8f0e0d39c5f52d36d8937c504f06f5ef5e9ec54fb98f3c61db910fefe5ab4c27d1c91c9c9e7688cd376b841c510090064fa563f412eeb91b9

  • SSDEEP

    49152:mj8saMWbZtUB8hSjRNTpGktKDJ3Ma1+Mf/bEA88pqhazt8JUtAl02F19NtvZk2:mosaxbZtJEj4rEAkJUcNdZr

Score
10/10
auroraspywarestealer

Malware Config

Extracted

Family

aurora

C2

79.137.133.225:8081

Targets

    • Target

      npp.8.4.8.Installer.x64.exe

    • Size

      4.4MB

    • MD5

      c0a7843660c41c0da01a91298f426c03

    • SHA1

      e94077a65ba887fd97d8824245bfdbfa914b464e

    • SHA256

      6c365c86aa823b55235be2d7f139160bfe994a33b2d34b73de239b24bbde7391

    • SHA512

      c97c0712555476c8f0e0d39c5f52d36d8937c504f06f5ef5e9ec54fb98f3c61db910fefe5ab4c27d1c91c9c9e7688cd376b841c510090064fa563f412eeb91b9

    • SSDEEP

      49152:mj8saMWbZtUB8hSjRNTpGktKDJ3Ma1+Mf/bEA88pqhazt8JUtAl02F19NtvZk2:mosaxbZtJEj4rEAkJUcNdZr

    Score
    7/10
    spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks