aurora | 3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168[.]exe[.]zip

General

Target
3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168.exe.zip
Size 1.2MB
Sample231012-a2drsadg3t
SHA256 1239d6078524d7a57f71ef2be163cef032d64ee357bff5d008c4ec6e234fc871
MD5 cd9faaea4718b13b02979eba8ca88e7d
SHA1 44bf1e45cbdcb52ab91541da3bd64e9e398704a0
SHA512 d9aa43c1aa670dc1f67085c46126dc7fdca58725c72be756efeff28ce3704f46c162a17da5093ba43c54f179a707b1d4375e39387ca941f5d57628c6b3bfa171
SSDEEP 24576:XUkExnuc7ysX6g/fIQ7+yPsqzyNvHa59IEJ5+fxV+4v+TqsqqF7nkmgeBB9Ojbqc:XNExnhu5g/fIQaYFzyo59IEJMK2OAqFS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aurora

Malware Config

Extracted

Family

aurora

C2

212.87.204.93:8081

Signatures

Aurora family
aurora

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168.exe

File Explorer

3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168.exe.zip

.zip 1.2MB
3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168.exe

.exe 3.1MB

3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168.exe.zip

SHA256 1239d6078524d7a57f71ef2be163cef032d64ee357bff5d008c4ec6e234fc871
MD5 cd9faaea4718b13b02979eba8ca88e7d
SHA1 44bf1e45cbdcb52ab91541da3bd64e9e398704a0
SHA512 d9aa43c1aa670dc1f67085c46126dc7fdca58725c72be756efeff28ce3704f46c162a17da5093ba43c54f179a707b1d4375e39387ca941f5d57628c6b3bfa171
SSDEEP 24576:XUkExnuc7ysX6g/fIQ7+yPsqzyNvHa59IEJ5+fxV+4v+TqsqqF7nkmgeBB9Ojbqc:XNExnhu5g/fIQaYFzyo59IEJMK2OAqFS
MD5 SHA1 SHA512 SSDEEP

Password

infected

3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168.exe

IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
SHA256 3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168
MD5 027a60b4337dd0847d0414aa8719ffec
SHA1 80f78f880e891adfa8f71fb1447ed19734077062
SHA512 009703b2c57258ccec76aa97807976e3ad693f3ff90b5417ae920e5860354bdaf4b01caaa850f1996391da5b6d75ebc38509a9b124fd9ae0660d7002b54b606d
SSDEEP 49152:ZRxujKxS2EuSIYkgSc71bdf5k6N21D5MwICiaiSLE6k1/lRr:ZRM282P2jScBbS2lRr
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

412704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

286KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

988B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168.exe.zip

3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168.exe

kernel32