aurora | 1c94232849d932848799887c3a014fcf224149c85ccaf4c0ee7b8c6ecebd9b5e | Triage

Sharing

General

Target

1c94232849d932848799887c3a014fcf224149c85ccaf4c0ee7b8c6ecebd9b5e
Size

6.2MB
Sample

230228-tz6vbscc25
MD5

509f5cc42dbf946c390b5a98a9f40ef1
SHA1

c370e4fdca023d3e22916d4aa1f08d573bc66a68
SHA256

1c94232849d932848799887c3a014fcf224149c85ccaf4c0ee7b8c6ecebd9b5e
SHA512

48846be3defe23a2dd6890acf000868e8f4018e42ab3d0ae098fb63042ec6e3cc445c8094108c16345abe300229dd0a143c68dff354ed7e96014c924539b6ce1
SSDEEP

49152:Ok+3S4u1A44Xhs+YzQyKgavsLFA8ugfmts2gk1i:nPAOz8qLO8uK

Score

10^/10

aurora spyware stealer

Malware Config

Extracted

Family

aurora

C2

116.203.245.173:8081

Targets

- Target
  
  1c94232849d932848799887c3a014fcf224149c85ccaf4c0ee7b8c6ecebd9b5e
- Size
  
  6.2MB
- MD5
  
  509f5cc42dbf946c390b5a98a9f40ef1
- SHA1
  
  c370e4fdca023d3e22916d4aa1f08d573bc66a68
- SHA256
  
  1c94232849d932848799887c3a014fcf224149c85ccaf4c0ee7b8c6ecebd9b5e
- SHA512
  
  48846be3defe23a2dd6890acf000868e8f4018e42ab3d0ae098fb63042ec6e3cc445c8094108c16345abe300229dd0a143c68dff354ed7e96014c924539b6ce1
- SSDEEP
  
  49152:Ok+3S4u1A44Xhs+YzQyKgavsLFA8ugfmts2gk1i:nPAOz8qLO8uK
Score

7^/10

spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1