General

  • Target

    00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc

  • Size

    4.5MB

  • Sample

    230324-q9lqcseg53

  • MD5

    1a4261cbca6e08e1d1db27e28f24f79f

  • SHA1

    6dcadc198a6ca77fcca32f5241f880e7ca583739

  • SHA256

    00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc

  • SHA512

    d8490b3d3174b7865a457f9b38153a1d55f3c61f973561d0a7ce23bc45f74259107ee26866c5c43bc2f2adccf2f6af9738031fc72e2c5a5e71eab8b229ea6531

  • SSDEEP

    49152:Ux/jPjDdnThMbhBQPjMv1rEp62/sHl9n3dGPyRWVnNYKTqLfdNoGYF3GI5IYvYp:Ux/TdnThzwvprHl537Qu9o2I5U1

Score
10/10

Malware Config

Extracted

Family

aurora

C2

82.115.223.77:8081

Targets

    • Target

      00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc

    • Size

      4.5MB

    • MD5

      1a4261cbca6e08e1d1db27e28f24f79f

    • SHA1

      6dcadc198a6ca77fcca32f5241f880e7ca583739

    • SHA256

      00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc

    • SHA512

      d8490b3d3174b7865a457f9b38153a1d55f3c61f973561d0a7ce23bc45f74259107ee26866c5c43bc2f2adccf2f6af9738031fc72e2c5a5e71eab8b229ea6531

    • SSDEEP

      49152:Ux/jPjDdnThMbhBQPjMv1rEp62/sHl9n3dGPyRWVnNYKTqLfdNoGYF3GI5IYvYp:Ux/TdnThzwvprHl537Qu9o2I5U1

    Score
    10/10
    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Defense Evasion

Scripting

1
T1064

Tasks