Mļq!���\Poq�y_|�� |�v�a�ȗ,U��1 �/l)Ie�Pm� (ӷ�������NH[�r ��:/c�T28b��� ��GR#|���(�ٿ:B{���A������q�V�:.Y�Hsn�A��.� �����T}�<����������w�1ؤ��O��= &H�9��S��X���oX1�_��:A�k��fHȉ�܁�͉&d�Q3{i,�|ͷ=y��rrf�?����d��P��{l,#x&B��?~B��=;0��;���|ILX�D�I,t\�D��!Y��! ����ma#��Z�.�&�Jڭ8��vȮ��Pd)�0fY:Ae��6�%��P���ط�^�ȯ����B�H]X�v�5Ea��V���D��7�D<����.��DN�=uE��Z9�0� N��Hk�G�DX?�W�r�1&��Ղ����S2��y勋A��.fM�].(��A,\3��b�^���d�;���@+c�`���p��°��o*��A��M���蹳$��҉c�IJ�T��"m��i���X�m��¬s��"�O�g]O�%����,�'��nC7�c�4|�y �@���)����:�|�T�z�� X��*�z�������������#k������v|���*�}bNM&B߲�}�����C�sƁ_Y2��E���ȏb�O���3L�o@�|�Q�1"(Fw�U.pD����� e��%G����.\���^�WHАF��������F��q�p3�r�hc���GG-�x�L��B�0+�E�T��F8w;ޞ�id��T�¯o���a���'��?�M����;C���rb����\��x��"8�NIf��`�~E����F��Zf�_�u��/On}�����X�dA�"���҆��x�Q����?��7���H)����8��f���J�m�E�̏�sG��D���o�ˌŏRg��Ϝw��C�t�ޭx���rT��ҕ�$�R(���-Tvo9��if|Uy�[��22a���!�̟s��½�)��ˆZm���K�r���/䒎�q0\����Z�m�W��hj���z����KPt��?���]w�Tu�|YE� �ԃ����Dp���z��ɻ@;�DK���@g3�~:�'�\O@��l�[g��d���{�����rő^��i����=�Z��p��'K���ۂ����Y�Cqs�� ���7�����@3�2Iˈ��Q���:#A_b��`n�✐5J�� =\6���s��1�㖸X��(��"����YggG+�-u�?������f�;��Ädˆ0����v�����<��_9W�����%�hbb�觑�����9Q�8�����¥��ߋ���!����ɋ05�c�秮�;�`8�Y��̹),�?��vZ�A#��N'��k��5��"�^�J��0� �,v��B���_�M��)�#��0�q��5R�#5���8�YW,�WO�����ހkfvt"����C��dɂ�{[ �xŚ�䗿2����)y'�kt� t@P-v!`1���j`,H�=✊R��y(�=j�w�>��u��O����/��Ρ� b�ۙYY�C��8z�\o�17X������sB���R�.G O^������ ���5������ʼ��� ��������w���S�#i�S�8� N_'a�)��]pf6��У�����7QĞƇM�{=z�E��8�Z���/��9��{��'�h��!�)��ХC���� �>� ⑳�|�ŋ�B�[�0�m�aq`�ĩ�4EyP�#Ig�a��wP�tN�wcy�����OT�F(s�������֗^��C���GVřw��[E��k�R�!�1�����ԅbG��Ṛe�}x�?�&�c���:AQp��� +��Ǵ ��aV���x��s#��/:�i���lP�B�oc��ç�`IɁ@��'�������{�g�,�A�`����R��j"�|�z{Y+�{�rjߙ�M�T����*:+������Bh�.�?|���*����dS��EY�5��p�����'qL͍�,��9����8��ׅ1V�j���7ڨ�pe��h����M�\RJ��R��Y��r�8AP���S�^H�s��`��[��~�!� ��/�G�$����n�̿�J�IG3��I4�ȗfXx����e�r��c/t?7���h�#�|3���]0���/ ��dmYl�*��d��u@hW�R���3;��ws+nZe��1�4��.���n8Eʄ�9��w������F�~�-z&<�l�|��w���A��<�(����>8�� �(��@fI��GtpҺ�l��['�'�ɑ!�a>d�&�\h��N��O�"�1X���Eߋc �e"vÍ'8pdo�u�eI��6��3j��E�5���i>zA;U�o�S�Y�-�~I�.\G�wH*��^3.�¬��������;B�r�}f�g���Lx'�ŝ����7V��+�Ë����G7cs�~ŏ��a����JLK��|�'zX�xdc����^c�Ң�|6n�K��fyY|�\%����k�c��%���iH���ϳR�����)�㞣�g��u��V��=u�b���4���j�D�i������4���0���gE!����!q�m[3b�R;�8O�(b�S��Æ�� ��%헗<�ЁS�O�ݺ���?Ajn��`�6{����Ɯ�5�b�UY��~��H���r���#�E�&��FﮣN��Zpyi�bp��r���×-гoh���җ�neL��) ��s���|TZ����Hr�Y��Z�vI#|�*�J����Q��$�[^Ern+�����"��?�cvġ�n+�� ����r�M�(/h�}��o�W�]�_rO�z/ǂ�Q��iNձ+@A���(��j���� O�Ƒ�5�\�\9A��Z_Fl�f� 'm���n9�2l����>�%�����ɕC�oRzW�r2N���b�/^�ֱA�����f��hz3�7�vɰ�y���XP�RR��=[�$T�W��_��E����
Behavioral task
behavioral1
Sample
AuraSpoofer_Free.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
AuraSpoofer_Free.exe
Resource
win10v2004-20241007-en
General
-
Target
AuraSpoofer_Free.exe
-
Size
4.9MB
-
MD5
d4e32bcad477dc4cd4515488fea5eb80
-
SHA1
d620f355af5fc57c7c1f475c01f5249ee7a4f777
-
SHA256
91aa2c362452adfaedca59df5932a40b3e206ed2f57565d443bd183442a4eeb4
-
SHA512
fb5cca4158c4b3b031d0df27fbf7bdb17879323948cdd4b0502a4c3e1f0fb8ff4a70f4abe430c9b24c6b7306c79052de9d3a468962634eb7c904c634fc872f04
-
SSDEEP
98304:jIqzsdZgbZdwkqm67fV/R5Pm0QCEKebsvimfaYlSJXn+j:rzuyaxfxPm0QCEKQsNyJuj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AuraSpoofer_Free.exe
Files
-
AuraSpoofer_Free.exe.exe windows:6 windows x64 arch:x64
904e45801fe61239a02a693f3bf18c51
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-stdio-l1-1-0
setvbuf
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ