Extracted

• • Target

    AURORA_STEALER/AURORA_STEALER.exe

  • Size

    11.1MB

  • MD5

    b4863ea5e21b52e6bb199de51671aa88

  • SHA1

    116b995556ef787c4b653999bf4ccf9cafa593a3

  • SHA256

    c39eeb965f63cf236d5458c8cecdd7c847e5d0aa56a2fb8009fb8ca6b8ebb046

  • SHA512

    5a5e7888512b0319092f39fcd139d3a75ced9fa6de7479d4a69f745bb8914f7173c4da664296c301e3654389f951b6acf9084db50f22ab30e482f20b0a6223f5

  • SSDEEP

    196608:JsgI2/3BGzono2r687IK4FHl+oRINQLNaX3PXtWWkYZvXrZomRmoyJTSVkXygu/Z:JpU2u478FhbaX3PXtWW9VloSmpTSVHg4

  Score

  10^/10

  aurorashurkinfostealerstealer

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • Shurk

    Shurk is an infostealer, written in C++ which appeared in 2021.

    infostealershurk

  • Shurk Stealer payload

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1