Overview

overview

10

Static

static

7

install_win64.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    install_win64.zip
  • Size 4.7MB
  • Sample230127-rmtywsbe88
  • SHA256 d13ec3096398daa37bbc870ab323733353f3da106fdc56acef3802f597db9794
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
auroraevasionspywarestealerthemidatrojan

Malware Config

Extracted

Family

  • aurora

C2

  • 45.15.156.210:8081

Targets

    • Target
      install_win64.exe
    • Size 470.0MB
    • SHA256 e41b7fabc955a219901ab142402f9fb1c1c81e1923240fbe7ea1f9e4f57e46ad
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    auroraevasionspywarestealerthemidatrojan

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks