aurora | 83d67c10baf6087354badb32305228e3addefca87641b2cf8fe7045daed43b10[.]zip

General

Target
83d67c10baf6087354badb32305228e3addefca87641b2cf8fe7045daed43b10.zip
Size 4.6MB
Sample240308-vvs84sdd51
SHA256 83d67c10baf6087354badb32305228e3addefca87641b2cf8fe7045daed43b10
MD5 fba5e1f4c44fdace80adb051d22cdbb3
SHA1 7e9e86471a0628a1578b488128ae67aa05debbc9
SHA512 0185ef82ba86b2771906aacda63c8bd94fdc4a787cecbb1b90b10edf3a5a21d4733f8dcc2d3ed6b66d7a094c8c0cc22e32a41a6af18b688b0293132c188e95ad
SSDEEP 49152:+iUVTWSq0Tp9feYHD53V1a4nBv2hlVKD5EWRueBj68gKgMQT02p:zSJN9hHDBVwoSls1ELeBulKgMQT02p
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aurora

Malware Config

Extracted

Family

aurora

C2

167.235.58.189:456

Signatures

Aurora family
aurora

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/runtime.exe

File Explorer

83d67c10baf6087354badb32305228e3addefca87641b2cf8fe7045daed43b10.zip

.zip 4.6MB
runtime.exe

.exe 1024.0MB

83d67c10baf6087354badb32305228e3addefca87641b2cf8fe7045daed43b10.zip

SHA256 83d67c10baf6087354badb32305228e3addefca87641b2cf8fe7045daed43b10
MD5 fba5e1f4c44fdace80adb051d22cdbb3
SHA1 7e9e86471a0628a1578b488128ae67aa05debbc9
SHA512 0185ef82ba86b2771906aacda63c8bd94fdc4a787cecbb1b90b10edf3a5a21d4733f8dcc2d3ed6b66d7a094c8c0cc22e32a41a6af18b688b0293132c188e95ad
SSDEEP 49152:+iUVTWSq0Tp9feYHD53V1a4nBv2hlVKD5EWRueBj68gKgMQT02p:zSJN9hHDBVwoSls1ELeBulKgMQT02p
MD5 SHA1 SHA512 SSDEEP

runtime.exe

IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
SHA256 ff3977b7044b3739035cbd17b6d462886b7e228d666c780b8a70c887af797243
MD5 12e85f4fb4973d62ebfd30cf52412512
SHA1 097d71e82681fbaa290f8bf2f49929a2a1206e87
SHA512 bc44f93e99813b124307611b64af16d37d27dc637c50ea9a0852d3907850219ac08cd0316a944762434186ab3e3f5cce4d2c13efd7d4adab95680f3368976f22
SSDEEP 49152:pyWMOEmrU4VWLP6zev05oej0EL9gCegK/efy5d8A45EG273LCV0UOQJUh9q101GF:Eq6PQn4/9GEp32VLV+h9sF
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

419040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

334KB

Virtual Size

730KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

83d67c10baf6087354badb32305228e3addefca87641b2cf8fe7045daed43b10.zip

runtime.exe

kernel32

generic

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

83d67c10baf6087354badb32305228e3addefca87641b2cf8fe7045daed43b10.zip

runtime.exe

kernel32

generic