aurora | 432a7171271b0d0135e2acff0e050b5f1a4b6a54a3f04d6e58d598f687c9c128 | Triage

Resubmissions

04-03-2024 16:51

240304-vc5jesgc48 10

02-12-2023 22:00

231202-1w5lesga44 10

Sharing

General

Target

WWSBot.bin
Size

8.6MB
Sample

240304-vc5jesgc48
MD5

d1b34597bc267179917191267189a4a6
SHA1

fd37c0f66c80e43fb503451f32527496dfb6e981
SHA256

432a7171271b0d0135e2acff0e050b5f1a4b6a54a3f04d6e58d598f687c9c128
SHA512

d848e7dae60ca4a13f4ed4a7cb0a2ae27e5b6865c4f1c617c0b528299e3489d84b49253528161b9e81db7ea51ade1eb6a993ac277ebadd2c4a860cebff2c8803
SSDEEP

24576:tN+qbmS6e/1ijwnQFpP1CJUmWw5/Ky9YawDZoaZC0gvbm49kLDA5gHdf6sxJwESo:WqbmSL/0wnQX1C3gk+lKbyf/z1

Score

10^/10

aurora stealer

Malware Config

Extracted

Family

aurora

C2

94.142.138.29:8081

Targets

- Target
  
  WWSBot.bin
- Size
  
  8.6MB
- MD5
  
  d1b34597bc267179917191267189a4a6
- SHA1
  
  fd37c0f66c80e43fb503451f32527496dfb6e981
- SHA256
  
  432a7171271b0d0135e2acff0e050b5f1a4b6a54a3f04d6e58d598f687c9c128
- SHA512
  
  d848e7dae60ca4a13f4ed4a7cb0a2ae27e5b6865c4f1c617c0b528299e3489d84b49253528161b9e81db7ea51ade1eb6a993ac277ebadd2c4a860cebff2c8803
- SSDEEP
  
  24576:tN+qbmS6e/1ijwnQFpP1CJUmWw5/Ky9YawDZoaZC0gvbm49kLDA5gHdf6sxJwESo:WqbmSL/0wnQX1C3gk+lKbyf/z1
Score

10^/10

aurora stealer
- Aurora
  Aurora is a crypto wallet stealer written in Golang.
  stealer aurora
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1