Extracted

• • Target

    bde9b23fbe4f12e5ff686c17cc9d9490.exe

  • Size

    16.0MB

  • MD5

    bde9b23fbe4f12e5ff686c17cc9d9490

  • SHA1

    f0a99fc9abe817705fcae04ec626abf263ffcc32

  • SHA256

    9012d01ae4d6db135651b4322c96846544d8e323ecafe5754026f7ea0c320d5e

  • SHA512

    6f6fcad5783c4c1ab309f4a8950026fd063de6059f98e24e3b460095a665b2d54168c07c3fd42f0644f002adb3a2f91f80fbabdd852a19205b45c5643e6ddfe1

  • SSDEEP

    98304:J2nlZSn0kF9Eh5euL3iuSr0/r5CBTZ8o0xnbREEwegXnrMOiRwF:AnlZSn0kF9Eh5sr0Ny09bREEweanI6

  Score

  10^/10

  aurorapersistencespywarestealer

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2