Extracted

• • Target

    50ed2d8e8d8d0509b7eb41eb7dd0b510b1d74d0fd283eccca2764a79c4e55493

  • Size

    1.9MB

  • MD5

    3df74698e0964dc8c5363d39a0537d74

  • SHA1

    070eb983cff0a83c77c3da4ff133ca37c0ade304

  • SHA256

    50ed2d8e8d8d0509b7eb41eb7dd0b510b1d74d0fd283eccca2764a79c4e55493

  • SHA512

    987b0c3a71b2e204a7d13b9472db00140e8789b739e1460df2c2ff2f449a958786677ab86452d1ec55a4dfa83ccfac10ee6586f6523670474eee41b9c9590719

  • SSDEEP

    24576:zRw6q5NMwgARkS7B+zz2xt+RvVwrnPdaJTCR+g5ad7x9E67K29r83BnyixLygaBu:Bq5NMMD48ngd7x9Bsn2HBDnC

  Score

  10^/10

  aurorapersistencestealer

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1