Extracted

• • Target

    C4Client.exe

  • Size

    687.6MB

  • MD5

    6dc896f98f315d59f7ff0a23ec918e68

  • SHA1

    e52e78a5f7eb29cd4eca84e47943fce5028961dd

  • SHA256

    0ce0f0ddf91c200d8a9c91c3c47f807ecc26de890de8e4dc83ec4f5a08404a06

  • SHA512

    2ac4b6f3f9014f33bc6e1a0d8fc741fbba2e6918d35bdf572bf19a4ff3ee576671796a0f52398afd620c67963fe4b6700fe8faae19f47c8517b3658263a30dff

  • SSDEEP

    3072:0nTjRD5V730BSng7tJr8Khw6pItWgAEqjAxou3e7BNIdOAg0FujDvktlL0BjMwmk:G1V7h2r/hwNWgAEqjAKmkAOECjMwm

  Score

  10^/10

  auroraevasionspywarestealer

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • Modifies security service

    evasion

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Stops running service(s)

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2