Overview

overview

10

Static

static

3

00151824f0...bc.exe

windows7-x64

10

00151824f0...bc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17460028106.zip

  • Size

    2.3MB

  • Sample

    240527-lqdhesfd81

  • MD5

    42391d40c4e3d441e5bd3174b190d451

  • SHA1

    b800b95c93e5eda09480f1c5962ad12ea3f7070b

  • SHA256

    1fc9d7f37520509a5872b4d6c5aa19d8a3c506b3d2da8c08eb93f2e10f3322e1

  • SHA512

    f07335bbf44b22eb4f502197866906c3b26c60ffeb7de280b82c3a732c6aca668e7b17649d680812335daabd447e93944ead6b4d9c523d00d40ccd5e57a8d653

  • SSDEEP

    49152:RKnRlFYWWiASX/cINkPucAWcyXKigCjts86JEWwMKoa:OeCUbZ4i1i9a

Score
10/10
aurorastealer

Malware Config

Extracted

Family

aurora

C2

82.115.223.77:8081

Targets

    • Target

      00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc

    • Size

      4.5MB

    • MD5

      1a4261cbca6e08e1d1db27e28f24f79f

    • SHA1

      6dcadc198a6ca77fcca32f5241f880e7ca583739

    • SHA256

      00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc

    • SHA512

      d8490b3d3174b7865a457f9b38153a1d55f3c61f973561d0a7ce23bc45f74259107ee26866c5c43bc2f2adccf2f6af9738031fc72e2c5a5e71eab8b229ea6531

    • SSDEEP

      49152:Ux/jPjDdnThMbhBQPjMv1rEp62/sHl9n3dGPyRWVnNYKTqLfdNoGYF3GI5IYvYp:Ux/TdnThzwvprHl537Qu9o2I5U1

    Score
    10/10
    aurorastealer

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks