Overview

overview

10

Static

static

3

AURORA_STE...ER.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AURORA_STEALER.rar

  • Size

    11.2MB

  • Sample

    230626-hes7ysgg69

  • MD5

    456c97b25ed197734c568cebf9136cda

  • SHA1

    ebfa2486cf3a4d8a85d2f84c681299cd2d23d9ab

  • SHA256

    bfae184d9a7b9bf26333c277a8a73e9e21d193bdcfc10e1cf737a8fcc877ef3d

  • SHA512

    6b5e2918bec08d1cef80e115579a24c2f99b7b0a31a4b2f1427b0ea01cd1c7ae1abfd33363447f75a42687271cb523926c77895b7842c71fa1f41eb8e66b6678

  • SSDEEP

    196608:oZcArwwv2vAEiL/R9bs9yGsd9oClS2i+jcAmNjabbkctYQBvC2R6y2bxd83CUHhF:HYwwuvSXGsd9T19cAmNOtnq2vSohxLj

Score
10/10
aurorashurkinfostealerstealer

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://rentry.org/xau9i/raw

Targets

    • Target

      AURORA_STEALER/AURORA_STEALER.exe

    • Size

      11.1MB

    • MD5

      b4863ea5e21b52e6bb199de51671aa88

    • SHA1

      116b995556ef787c4b653999bf4ccf9cafa593a3

    • SHA256

      c39eeb965f63cf236d5458c8cecdd7c847e5d0aa56a2fb8009fb8ca6b8ebb046

    • SHA512

      5a5e7888512b0319092f39fcd139d3a75ced9fa6de7479d4a69f745bb8914f7173c4da664296c301e3654389f951b6acf9084db50f22ab30e482f20b0a6223f5

    • SSDEEP

      196608:JsgI2/3BGzono2r687IK4FHl+oRINQLNaX3PXtWWkYZvXrZomRmoyJTSVkXygu/Z:JpU2u478FhbaX3PXtWW9VloSmpTSVHg4

    Score
    10/10
    aurorashurkinfostealerstealer

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Shurk

      Shurk is an infostealer, written in C++ which appeared in 2021.

      infostealershurk

    • Shurk Stealer payload

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks