Extracted

• • Target
    e41b7fabc955a219901ab142402f9fb1c1c81e1923240fbe7ea1f9e4f57e46ad
  • Size 470.0MB
  • SHA256 e41b7fabc955a219901ab142402f9fb1c1c81e1923240fbe7ea1f9e4f57e46ad
  • MD5 3ee5dfca3eadc77f2bf61894d582cc66
  • SHA1 17f5f51c3439e54b22df194968977653104298d2
  • SHA512 c3ecef9bc6b51e430264a494bb3e9237ca539c7e3f1d4b3f18988e2953bee7cf46b06a2f24ca1535e8cbf514c6059e5c444c74dace355f845b08d8d7ad4bb239
  • SSDEEP 49152:LhK10rlzIwe6he+dM1ckuKqMm1kdCabcUwoTnfyL6gNLh65eDm0drmjKoSuMelqi:cirlzMIdHvbMCacUFKbNo8DmGOpMwqPq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  auroraevasionspywarestealerthemidatrojan

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2