Extracted

• • Target

    a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d

  • Size

    3.0MB

  • MD5

    4b32941cd92e048e6a2d16c6069edf62

  • SHA1

    5d167b4588575ffbc7a06cd9fa22552dced38951

  • SHA256

    a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d

  • SHA512

    8b5c75642960991648fd18fb2c5421f8d082f0982a4b5950dd091547dc53943fccb287a404593fbb08282188c3c94d75e05c28f1a58f83a5b6559f34a516442e

  • SSDEEP

    98304:6fFbrdnYUGkQqOSlBk1G4QBeKW0wnpTX5OIX:6fFbhBMqOxFgW3nRr

  Score

  10^/10

  auroraevasionstealertrojan

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1