Extracted

• • Target
    setup_win64.exe
  • Size 2.8MB
  • SHA256 d7d25a827de912a5ed8e3d8eb4e6d26b20b48834b6cbf99c72162f9f74e62364
  • MD5 dafe5a638249c8479349a21d8a285b80
  • SHA1 4f930b8ee8343d2c5c675e1b100e75f42a3867d1
  • SHA512 8f3893cae904d4e5c5faf1dc7373a0d68814dae6a3d5f28bc32bf382f07ce58ac5172a1ef1504131cb42527293042582de68e26f1ff8a602c4876bbc799d84bd
  • SSDEEP 49152:NhLw96g9fhkl8asMCW4YAAgSRJWDnO6dRqTr+Wn8D/hnN1/gisnopApkdkRcwqj4:Ij9fhkl8asMmcg1DnTdi18D9zI3nop3c
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  auroraevasionspywarestealerthemidatrojan

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2