Overview

overview

10

Static

static

tmp780A.tmp.exe

windows7-x64

10

tmp780A.tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp780A.tmp.exe

  • Size

    4.0MB

  • Sample

    230126-12hc3sha21

  • MD5

    58f86d3f8a1f981a7c7bf541c3bc787b

  • SHA1

    a6b43c84c1b79551b39fc7c589deec969de84227

  • SHA256

    5ec2cb39e7538c4c2eaedcd2c2ce1ea79665260e14ff5b6579e33829c06c0235

  • SHA512

    88dd8807bbc2ad6f93eacc729489d4a859edf310becfafb788c69de80b716780dde739604d53656be8cbec160c940392d24344d2737ff9d25e064f29989b7719

  • SSDEEP

    98304:j5p0FLvYwv0qdE+T/6dBVeAhy5zhLaHtZO3jB9L0l3nHQvvw4:j5KpvNJHj6dXEnLuZOr0Znw

Score
10/10
aurorapurecrypterdownloaderloaderspywarestealer

Malware Config

Extracted

Family

aurora

C2

79.137.133.225:8081

Targets

    • Target

      tmp780A.tmp.exe

    • Size

      4.0MB

    • MD5

      58f86d3f8a1f981a7c7bf541c3bc787b

    • SHA1

      a6b43c84c1b79551b39fc7c589deec969de84227

    • SHA256

      5ec2cb39e7538c4c2eaedcd2c2ce1ea79665260e14ff5b6579e33829c06c0235

    • SHA512

      88dd8807bbc2ad6f93eacc729489d4a859edf310becfafb788c69de80b716780dde739604d53656be8cbec160c940392d24344d2737ff9d25e064f29989b7719

    • SSDEEP

      98304:j5p0FLvYwv0qdE+T/6dBVeAhy5zhLaHtZO3jB9L0l3nHQvvw4:j5KpvNJHj6dXEnLuZOr0Znw

    Score
    10/10
    aurorapurecrypterdownloaderloaderspywarestealer

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Detect PureCrypter injector

      loader

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

      loaderdownloaderpurecrypter

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks