aurora | da462cdcf0fc7280a05841c7d7794f55b029d42870e6dafe3cf24a62b3d5594a | Triage

Sharing

General

Target

9cefcb5159eb84462e72f33b45afad46.exe
Size

10.3MB
Sample

230215-w26nfsda5y
MD5

9cefcb5159eb84462e72f33b45afad46
SHA1

a18368fccbcc300cd06db1b0939ada72e05ed041
SHA256

da462cdcf0fc7280a05841c7d7794f55b029d42870e6dafe3cf24a62b3d5594a
SHA512

0f87ddfce54a6296d6dd7468d04399adb528c00d03004ec7c1bc91b41912808ef74a58d8d89409262db317f3921a39925d32335957d0d0d801d7c932ece1adf1
SSDEEP

24576:TjQqWQFDtb+5lgKgOY0BC2i7Ay2AA0IvkGDx2kRxvRniX3eUiykzC/qGqLmWsMPi:TnWQ9tb2X7BCgW05+2Wz1

Score

10^/10

aurora spyware stealer

Malware Config

Extracted

Family

aurora

C2

94.142.138.18:8081

Targets

- Target
  
  9cefcb5159eb84462e72f33b45afad46.exe
- Size
  
  10.3MB
- MD5
  
  9cefcb5159eb84462e72f33b45afad46
- SHA1
  
  a18368fccbcc300cd06db1b0939ada72e05ed041
- SHA256
  
  da462cdcf0fc7280a05841c7d7794f55b029d42870e6dafe3cf24a62b3d5594a
- SHA512
  
  0f87ddfce54a6296d6dd7468d04399adb528c00d03004ec7c1bc91b41912808ef74a58d8d89409262db317f3921a39925d32335957d0d0d801d7c932ece1adf1
- SSDEEP
  
  24576:TjQqWQFDtb+5lgKgOY0BC2i7Ay2AA0IvkGDx2kRxvRniX3eUiykzC/qGqLmWsMPi:TnWQ9tb2X7BCgW05+2Wz1
Score

10^/10

aurora spyware stealer
- Aurora
  Aurora is a crypto wallet stealer written in Golang.
  stealer aurora
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

auroraspywarestealer

behavioral2

auroraspywarestealer