Overview

overview

10

Static

static

10

Aurora/aurora.exe

windows10-2004-x64

1

Aurora/web...IX.xml

windows10-2004-x64

1

Aurora/web...e2.xml

windows10-2004-x64

1

Aurora/web... 2.xml

windows10-2004-x64

1

Aurora/web/bot.html

windows10-2004-x64

1

Aurora/web...s.html

windows10-2004-x64

1

Aurora/web/ds.html

windows10-2004-x64

1

Aurora/web/index.html

windows10-2004-x64

1

Aurora/web...min.js

windows10-2004-x64

1

Aurora/web/js/main.js

windows10-2004-x64

1

Aurora/web...r.html

windows10-2004-x64

1

Aurora/web...s.html

windows10-2004-x64

1

Aurora/web...c.html

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Aurora.zip

  • Size

    30.2MB

  • Sample

    230519-2n7lgsgg45

  • MD5

    ae4250c2e74579716bedc36a86e5ba66

  • SHA1

    6a335a29e32d0320eeb5a6460b951e98c5a25ab9

  • SHA256

    e4e84e4c05fcabc3248a398ff3b4d14794f0c7591e192b3bfdb4ab3c9c1cd9ab

  • SHA512

    719e596bf01724ea937a3fdf34dd33872c753a6f90086337dec706989d814ec9ee047d7afca13d9884e2f8f42453ac0756763e6453eba610b1dc6b35d3db64a9

  • SSDEEP

    786432:+1w6GWVzHwNmfcLaM6bL0/WIPOInlK7WzsxRz7fZKbkgGi6:+zVbeOwatLC3PcysxRz7fZKbkg8

Score
10/10
aurora

Malware Config

Extracted

Family

aurora

C2

185.106.93.237:56763

Targets

    • Target

      Aurora/aurora.exe

    • Size

      10.0MB

    • MD5

      83fbded097edeeeec35ebb02e6f58efb

    • SHA1

      0b2ee0d31fceb7108c0fdbf160ecbc7a0d3f74b1

    • SHA256

      ebd1368979b5adb9586ce512b63876985a497e1727ffbd54732cd42eef992b81

    • SHA512

      a70f52eebca88019ba06c2b22ac0d0119d23a1b7b358c6132d617eb444a76eb299fa2c211c1b83d4d32377aaf62a1e56e90f5c36a0e76456d96a724739a70529

    • SSDEEP

      98304:TOcegIdwqxPLEx6AfWOk3FeCN5RLVzS2pTTDrx9mhgEUwvR:TefGqawAeOk38CrRdvmhtU

    Score
    1/10
    behavioral1

    • Target

      Aurora/web/4x3/MIX.svg

    • Size

      1KB

    • MD5

      04434f91db287d1438c1426f72534f60

    • SHA1

      67ae948bcffe395cd99ed75e0787adda89596ae7

    • SHA256

      233695ad5db853bcaadb115a0ab6d85a65a9d8faee85513281fc61858609ebfb

    • SHA512

      157870619ad8ac1c69229d149eab297fc2ec046cbe05788a48324eec591e90a5c72063c3602bfa580f0e2a2b392a7df4e65a4bc2c38b2cd4efda9bb9cfa94b55

    Score
    1/10
    behavioral2

    • Target

      Aurora/web/assets/Ellipse2.svg

    • Size

      485B

    • MD5

      0ad775b72aa74cae0db732655b9ac041

    • SHA1

      4e6b2bf9d7c46bb81934325f37fd2e2ba5bc226a

    • SHA256

      061b3b0ada2cabedb8deaa5fb039dd8850321b8e7ed4a76587a6b3723aa5ea31

    • SHA512

      b0886b68476a08d87adce71eabb254584c8f3119385235ec761d19b9a2ef7cbc2030cffa6e836dbaf00b4fb78e379b992cecec4d974698b43716c858556c1e7e

    Score
    1/10
    behavioral3

    • Target

      Aurora/web/assets/emoji-heart-eyes 2.svg

    • Size

      2KB

    • MD5

      09cdf3768f6198d89aa7836154cacfcf

    • SHA1

      e8f42cd6ce969abbfe636580af9ebda9e4c8b157

    • SHA256

      65ea216efe36abcdc525de68990a4f4c2b64ff28707efc1e387285979988e290

    • SHA512

      aa393d663f5f4b28428786fdc995fb4cfb9e58960083208ac9308a048c0b5d5f46d098634a5f6d69677f77dd91fe5438911c6c071d6db70d5fd82a27e7b23a88

    Score
    1/10
    behavioral4

    • Target

      Aurora/web/bot.html

    • Size

      50KB

    • MD5

      f2ac5f00e667230fde09c37f8c462e2f

    • SHA1

      04822b4470beaff59ddd9820b19c3581f77e6b0c

    • SHA256

      8b1abbb51594b6f1d4e4681204ed97371bd3d60f093e38b80b8035058116ef1d

    • SHA512

      2a80e943662830b4a66e75d86cbdda61e47e1c2a1fd9a0a42f4c79cd0e5e7c2bdf54d3569afed512bb40b506ec29bb2595c49c87102e820c615f339790c2b4a8

    • SSDEEP

      384:ilTId+dEX5/WyAbFE/2kAE1lpFD6l+XqhzpP7OSpEtrri4p+HarVbmQfiJQfiGQD:iTEX4WJI+ZFQWbCFhUIB

    Score
    1/10
    behavioral5

    • Target

      Aurora/web/commands.html

    • Size

      46KB

    • MD5

      b471f17f6058643084420cf1beeda806

    • SHA1

      540751cae241a1b2b25d4dd78f7d1f52967ca8d2

    • SHA256

      e9cf3e7d2826fa488e7803d0d19240a23f93a7f007d66377beb1849c5d51c0af

    • SHA512

      8630f6843d626426d1a00379d4da44d31998009699b9994c817401604a8752306d1e6002d51425e108f26c594ee43029806c85f6c5d2bed398f6f3407e6027a4

    • SSDEEP

      384:6qlId+dEX5STyAbFE/2kAE1lp4a5D6l+XqhzpP7OSpEtrri4p+HarVbWQfiJQfi9:6IEXWWJ4aM+ZFQWbSgJn7sh2uCHIN

    Score
    1/10
    behavioral6

    • Target

      Aurora/web/ds.html

    • Size

      55KB

    • MD5

      76f09673ac96b4cbdc1a4271f6d3c44d

    • SHA1

      ff366b0029b3725e720c7dcfd0872c5cac2b9e68

    • SHA256

      1def6bdec3073990955e917f1da2339f1c18095d31cc12452b40da0bd8afd431

    • SHA512

      dcd2d5003645a1e1363083abf9f171947c762254b272d937bdaeae58cedb56e54fed8ee37454b6cc028b50c1d3b3873c08372613d0dad259c2b5d31223f791a0

    • SSDEEP

      768:rxEXGcWJX+ZFQWbBPeHPOhnwLw52uCHI8:rHcWAPhnj5xEI8

    Score
    1/10
    behavioral7

    • Target

      Aurora/web/index.html

    • Size

      74B

    • MD5

      7f2ecdbcb581b2ed6da4d8d3156b2558

    • SHA1

      4dbe1386aea5d0f1644db64eff3f5f6b05e8ade7

    • SHA256

      87635864b24fd38a1fce814301b4ebef9addc96caca2c0783f8a74412d8071ea

    • SHA512

      a7a33a20693a05ac90d2400383926f567bb865ce9e61d765ef7ca0f6ffa99c9f5bde11282a86e5632058cda5c0d35d5ea899ac391b3e4dd0734df0fe26ed4ed0

    Score
    1/10
    behavioral8

    • Target

      Aurora/web/js/app.min.js

    • Size

      465KB

    • MD5

      5ed5f8af5f246a29820fb875f563507f

    • SHA1

      ac0523ff2dc729f5d8af346359f96dd9ed5255f2

    • SHA256

      16691c1cebb95b2e0af0a8061cd8f0545dced6dc1191aa5b4b9c4619417cf3cc

    • SHA512

      db8280aa102985897e3ef3c55b4378f79bb8b78d6f83d298820d9198974d73e8d92b5b288f1f29f34048773f7a71f7b14cf6fae43939bec65564943e592556ce

    • SSDEEP

      6144:gmyIYneUpRxmbFmYHtyJoa0cWRkIBOs+G85H3JBrqmcJURSfAs7eiFaLRnPpx8Li:gmyVb

    Score
    1/10
    behavioral9

    • Target

      Aurora/web/js/main.js

    • Size

      1KB

    • MD5

      69f8e1d04cb2292ec4ed3c40a8a77ff8

    • SHA1

      cfa03dada1e766aa41846d868c6467c41ad86254

    • SHA256

      abb591fb5c5c3a2a38cbf68fe7db4cfbca01bf5bfcfbf5ae13c999ca1290f740

    • SHA512

      3e467a7c06d15b317d00526c21d04c33fc0f94aba7796560a27e77b6295127ed5693f8d7efee02a6240ceef0fe138df667b8bfd2339b1dfa0f0159d492034df4

    Score
    1/10
    behavioral10

    • Target

      Aurora/web/rergister.html

    • Size

      16KB

    • MD5

      1b11a8aadc72b2b6849c173edd89cab9

    • SHA1

      4a81908f7c2b8a3c1d1f8295753952bd433d54c4

    • SHA256

      d7829f17583b91fb1e8326e1c80c07fc29e0608f1ba836738d2c86df336ea771

    • SHA512

      6c92e567be238b55e1c003f17ff26f0a7f2a623900a3926117c64cb2802473c5ce4c3bcb6e41c6ab7596015f6581c9d1868fd1d40b53423483ca8c4159e2b2b8

    • SSDEEP

      384:8AId+dEX55sD+Egz5k29nGCBmcWaswjwarwTR7ZU+Xxmi:LEX7sD+cYpjwaE/U4Ui

    Score
    1/10
    behavioral11

    • Target

      Aurora/web/settings.html

    • Size

      61KB

    • MD5

      3b88dccfbe45812174b6ca51c3518cb5

    • SHA1

      819c0c37389be53989ca25c3529c1473bebd0d64

    • SHA256

      1b88624936d149ecdea6af9147ff8b2d8423125db511bdf1296401033c08b532

    • SHA512

      ebcd9bf0fff3959299be89ca79d7e73968204e367fb827fd4f71f2818aab8fdb6d23d517ee2a53e5dc775e9d8d579753742c9e784bda2f581542bb1ad1169cf6

    • SSDEEP

      768:wEEXWWJX+ZFQWbV8KZ8KB8KH8KC8K98Kb:wMWAE

    Score
    1/10
    behavioral12

    • Target

      Aurora/web/statistic.html

    • Size

      10KB

    • MD5

      72208f63646db492311708c3d1561516

    • SHA1

      d9997465b824b261cfe5a70ce1aa857e383f0991

    • SHA256

      f1ba92ae32fcaeea8148298f4869aef9bcd4e85781586b69c83a830b213d3d3c

    • SHA512

      67b0186c8c770a66d983f1b8795f7821773e9defb9bb632c2f68af4c7d1b6bf09497026ec244f4f95bfa6be312ce00edfaec904083afcec568891257beb6e298

    • SSDEEP

      192:M7oT3Mx2aMp/RdEYiYolNOVX2VasSG+EgxVX2VasSG+EgMOVX2VasSG+EgHden:McId+dEX5PasD+EgGasD+EgkasD+Eg9G

    Score
    1/10
    behavioral13

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

7
T1012

System Information Discovery

7
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks