aurora | ce117b0b7aff5bf55822e7e879b76fe9[.]bin

General

Target
ce117b0b7aff5bf55822e7e879b76fe9.bin
Size 1.2MB
Sample230327-cntxysdc2w
SHA256 27eb65438c793262b993bb2a42ff308e13631a82b6b6639c4fce0cfa1a02f87c
MD5 fb5d942ede8bd9c85c6ba8f8e6e87bed
SHA1 4fdc32e0588f65526c4878be4e75dbbe1bd6c2e3
SHA512 7912cd719373eafb2707ec229cc72957571b9489ef0cbccb8252c567dff2db32a087f48e1123910754a16a5d3344ca74775f951743c14cf830be0cd1e9d6564c
SSDEEP 24576:tIXt8Ma0iahnD4OXfWAdmvfKvVJnSyGkQD2rSCa1Y3X:tU8MaHunHfd7J1mCumX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aurora

Malware Config

Extracted

Family

aurora

C2

212.87.204.93:8081

Signatures

Aurora family
aurora

File Explorer

ce117b0b7aff5bf55822e7e879b76fe9.bin

.zip 1.2MB
28f76833c4943138b2a119a8a66b65aff15b7b91b331865ac21b523fdca0f7f7.exe

.exe 3.1MB

ce117b0b7aff5bf55822e7e879b76fe9.bin

SHA256 27eb65438c793262b993bb2a42ff308e13631a82b6b6639c4fce0cfa1a02f87c
MD5 fb5d942ede8bd9c85c6ba8f8e6e87bed
SHA1 4fdc32e0588f65526c4878be4e75dbbe1bd6c2e3
SHA512 7912cd719373eafb2707ec229cc72957571b9489ef0cbccb8252c567dff2db32a087f48e1123910754a16a5d3344ca74775f951743c14cf830be0cd1e9d6564c
SSDEEP 24576:tIXt8Ma0iahnD4OXfWAdmvfKvVJnSyGkQD2rSCa1Y3X:tU8MaHunHfd7J1mCumX
MD5 SHA1 SHA512 SSDEEP

Password

infected

28f76833c4943138b2a119a8a66b65aff15b7b91b331865ac21b523fdca0f7f7.exe

IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
SHA256 28f76833c4943138b2a119a8a66b65aff15b7b91b331865ac21b523fdca0f7f7
MD5 ce117b0b7aff5bf55822e7e879b76fe9
SHA1 95ae4fb73efc7d9fcdd05664ac458787c8280a06
SHA512 90bb0f400822e97bde74bf8f62d67235c948d355e86b21c508f61b793dc9fd5d0444308d947b661e0d51de42f4a93e8cbb1646193db66cd3c5210a385c0ca6e3
SSDEEP 49152:ARxujKxS2EuSIYkgSc71bdf5k6N21D5MwICiaiSLE6k1/lRA:ARM282P2jScBbS2lRA
MD5 SHA1 SHA512 SSDEEP

windows x86

Password

infected

Minor OS version

Major OS version

Entry point

412704

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

286KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

988B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

ce117b0b7aff5bf55822e7e879b76fe9.bin

28f76833c4943138b2a119a8a66b65aff15b7b91b331865ac21b523fdca0f7f7.exe

kernel32