Extracted

• • Target

    tmp780A.tmp.exe

  • Size

    4.0MB

  • MD5

    58f86d3f8a1f981a7c7bf541c3bc787b

  • SHA1

    a6b43c84c1b79551b39fc7c589deec969de84227

  • SHA256

    5ec2cb39e7538c4c2eaedcd2c2ce1ea79665260e14ff5b6579e33829c06c0235

  • SHA512

    88dd8807bbc2ad6f93eacc729489d4a859edf310becfafb788c69de80b716780dde739604d53656be8cbec160c940392d24344d2737ff9d25e064f29989b7719

  • SSDEEP

    98304:j5p0FLvYwv0qdE+T/6dBVeAhy5zhLaHtZO3jB9L0l3nHQvvw4:j5KpvNJHj6dXEnLuZOr0Znw

  Score

  10^/10

  aurorapurecrypterdownloaderloaderspywarestealer

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • Detect PureCrypter injector

    loader

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2