Overview

overview

10

Static

static

1

Aurora-Ste...in.zip

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    286s
  • max time network
    279s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    29-10-2024 13:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Aurora-Stealer-main.zip

  • Size

    19.9MB

  • MD5

    1ee8ee4451acbed67105936ee445a5ac

  • SHA1

    1382a2cda3cf2a288fd7b842f25bdeb500314cb1

  • SHA256

    62c6c51f713099e34da161990866e9e9f29495819cb176c914119a09a29a7c1f

  • SHA512

    d48586bc86846d1f6c70ff37bf84a5691ed1d59ac49d6a327d58aa40a751e3b8aef0e383f5c8b11501d453e193723935a31fda7d943413f2b61315a9321054e9

  • SSDEEP

    393216:/DjvrXK10QzlBD5Z6qQPTgH5YQhohyPovOtBPfjbPmGD3ObxcYzvvT7Ycgp4Yn:7jvrauQzDrQrgCQhSycOtNBy3vKp4Yn

Score
10/10
asyncratstormkittydefaultdiscoveryratstealer

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

Mutex

hwqarkrmtsomtkbpmu

Attributes
  • delay

    1

  • install

    true

  • install_file

    MpDefenderCoreService.exe

  • install_folder

    %Temp%

aes.plain
aes.plain
aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Async RAT payload 2 IoCs
    rat
  • Executes dropped EXE 10 IoCs
  • Program crash 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Aurora-Stealer-main.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap5909:134:7zEvent12875 -ad -saa -- "C:\Aurora-Stealer-main"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2884
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3416
    • C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x64\Aurora.SetupPanel-x64.exe
      "C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x64\Aurora.SetupPanel-x64.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4440
    • C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x64\Aurora.SetupPanel-x64.exe
      "C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x64\Aurora.SetupPanel-x64.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1608
    • C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\Any CPU\Aurora.SetupPanel.exe
      "C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\Any CPU\Aurora.SetupPanel.exe"
      1⤵
      • Executes dropped EXE
      PID:756
    • C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe
      "C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4312
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1364
        2⤵
        • Program crash
        PID:2968
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4312 -ip 4312
      1⤵
        PID:1940
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4708
      • C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe
        "C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3684
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 1284
          2⤵
          • Program crash
          PID:2188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3684 -ip 3684
        1⤵
          PID:4824
        • C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe
          "C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1288
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 1336
            2⤵
            • Program crash
            PID:3236
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 1288 -ip 1288
          1⤵
            PID:4684
          • C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe
            "C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe"
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4248
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1316
              2⤵
              • Program crash
              PID:4264
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4248 -ip 4248
            1⤵
              PID:3992
            • C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe
              "C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe"
              1⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3088
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 1280
                2⤵
                • Program crash
                PID:4760
            • C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe
              "C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe"
              1⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2880
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 1332
                2⤵
                • Program crash
                PID:4420
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3088 -ip 3088
              1⤵
                PID:2300
              • C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe
                "C:\Users\Admin\Desktop\Aurora-Stealer-main\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe"
                1⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4656
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1324
                  2⤵
                  • Program crash
                  PID:1688
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2880 -ip 2880
                1⤵
                  PID:812
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4656 -ip 4656
                  1⤵
                    PID:1728

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Aurora.Panel\Any CPU\Aurora.SetupPanel.exe
                    Filesize

                    323KB

                    MD5

                    8ec275f5417ef0f26c5e346900755d6c

                    SHA1

                    7d95dc2c9abdaa3a23423556bebae0a84eb4f6be

                    SHA256

                    b20a6bc557f7dc9174f1654e00d711d52739518e9de2657d5866a2d88388ebae

                    SHA512

                    b0cfa8656f7af82c8bd9788c314d43ce0597e63a4dc9e0844fef06da9500e34825ac11e3f9295ab5eaa8ee3ea07074129ca0d4958e74368091163035b4f8f50a

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Aurora.Panel\x64\Aurora.SetupPanel-x64.exe
                    Filesize

                    323KB

                    MD5

                    0b76c5318272e992c51a063bd834679a

                    SHA1

                    3d7f3f87553ac86463ae723d8db2eb6d0da06843

                    SHA256

                    1753237c84f0c71f6a64278b8c49e39950d90bcf5b8632e744a9a66c0972290d

                    SHA512

                    6bc581e538028de93f715d023e70739e82f5e16ca9e4a1e5780748ccd0423ad86aa5101105e8bfa6d0311018722eb025c2c4bbc76eb244573e19d0216958c9b4

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Aurora.Panel\x86\Aurora.SetupPanel-x86.exe
                    Filesize

                    323KB

                    MD5

                    e6e548624d15b7bca746c4be41a5de2d

                    SHA1

                    6aeeeb48ee79121e96a8daf0151fb5c0835cb7e6

                    SHA256

                    d37ceab6e81a130533858f7723394e7a2c48800719758e1ab64827545fb60639

                    SHA512

                    3c73f1bab5924c5852c4d3a6faf9383d23e675deddd953dbcd578da7ab4ad8ab4eb76a8c4c8afacd73a77e1e1e44f9151de2c03dfa85a4d501138f2ab7f91e59

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Instructions\README.txt
                    Filesize

                    1004B

                    MD5

                    92595ea3ca3fffb38f38656f52575c3a

                    SHA1

                    81a52367e76b646d2817016743d749ae17307598

                    SHA256

                    5382a2a0fd9eb3d189a8ff7401ada74e9a2bda1b71949058f2bf6fa7391f6720

                    SHA512

                    0c7ff2f8a2d3f56b82ec073e7de957d81c013d6b136995e273b0fe23e9b51ef23e648a1b3892bfde74521b59d457cad9891a1781d57f878fc99d4061e49a906f

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Audio.dll
                    Filesize

                    23KB

                    MD5

                    c16fccda2cdcf374df662c8035ed287c

                    SHA1

                    ed32b20dde3c884d80eab36a7096fbcb9432fbeb

                    SHA256

                    158e664b0976c0ae9594d7f57ff44ba298ca50dcf43fcdb76df5ff1893537800

                    SHA512

                    50a8b94b4089f59113a92033f685aa8037131d96423d412b53326a1c9f46529654e0776858977aae1448b4be3b16cd83c9eda5cf5352464a156f2343ff7c5480

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Discord.dll
                    Filesize

                    25KB

                    MD5

                    7a9892f86badfa7560fd9182a775fb73

                    SHA1

                    4ac58c122bdf7ad51e3ba8ff6151b545a258ec34

                    SHA256

                    84c4a1f90507955ce9ff3e8c260bbacdb57b4d230853d2fe1379fdbc98938c7b

                    SHA512

                    6b646d83011444972c8b9b38f886035d4bef498d40299ebc3f80da1fc7b3d3b02fbdff1fb355574059f1a6309ebaeeba7aa8f7aa26c99b7452bcaa1ad04259ec

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Extra.dll
                    Filesize

                    31KB

                    MD5

                    f5bf218ad015cae03530be7c8f0868a9

                    SHA1

                    d47c3936fded28dd4330f1aac7881d8bb17a1d02

                    SHA256

                    42b16d214b9336027c3e854c119739fac4cceac6e91045f69d1db18144b538bd

                    SHA512

                    a6c5a0cf8834de88b8df202c94de30521af3e7f8edfa213e896dac1c03096faa128fa38555bd9683d3d5819cdd34572f7cf061b9f841b823e13db9325cb5f090

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\FileManager.dll
                    Filesize

                    32KB

                    MD5

                    5d429feae7e6513205802ccdd0012a90

                    SHA1

                    0262c5caa56e33af56ac1e2799bfe9fd5f4f5977

                    SHA256

                    b2417948b649d6575597e82c87903a83b0d575776180b5aa3f4c2fb03504b488

                    SHA512

                    db865c7262330818682e3d6a011e07ff6b79c70ba3507e1206cbf2b88b9d9e4bbf888384b71ce27993296c21f2a883aa8de6f435aaf9a7a8a6e8a2c80720b468

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\FileSearcher.dll
                    Filesize

                    278KB

                    MD5

                    965f3d108d5995ba6214b32ce416d669

                    SHA1

                    3c2c219e053b3a692e37a59cd28db702da2af8d9

                    SHA256

                    05ee33a9f85545c43fbab3443751cdd0b151147f4665cfd3a661bae610b8e6b0

                    SHA512

                    f6d041219f5f5f1ee270812e5b4565465ce7c245636661d296a4dbd93b672bf1c3eaff890f84766c8f6b81ca14d5680e9bf8ed0c8a470018733c38dcb3897753

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Fun.dll
                    Filesize

                    34KB

                    MD5

                    6498fbaa8d0f46e9cc7eb5350db0d226

                    SHA1

                    2b6502e636cf3a307fdd9417c33215e95fe133ce

                    SHA256

                    1aacbe29bc2ba2fa3b23e632ba4d0f31b21d9b7517230af75b943eed06e42c10

                    SHA512

                    3df2476cff49da2e322693ff5751d8cbbbffa03e063e9a74b3141e95f99e03a6ddc84d4ded4d2bd28937135e73615f6b9d810741a864d196c7aab4089d744c6e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\HVNCStub.dll
                    Filesize

                    99KB

                    MD5

                    7aacab605cde7921393717a7e8166dc5

                    SHA1

                    ee682cadb9ff61e752a20bd1a58bd415a9ed0c70

                    SHA256

                    b4bd45ceed51bd8242575be1a804c96bde28e23603e29517ab87ad2fb21ecbc3

                    SHA512

                    e1bb3c39094e550a0e92f0ad678d078594f7ae8a06941574415444a900b8179bf2073035f5bc7e834d8aa8f06cc12aa0b325b0718e8ba9f5acbb3fcc3be11e16

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Information.dll
                    Filesize

                    24KB

                    MD5

                    09659d665bef5d2b13064ddbadbf9c3a

                    SHA1

                    0bcf0c1a8d83ed569eeb78e61e1977f39c76a304

                    SHA256

                    b7e5626e056b7cc14515f9736ff02f7d102f585f256da388c650900ed333455f

                    SHA512

                    5c5e7ad42240d05c4dfdccf2eaf3f34a25a5bc40e06194a7224c28036d5031161f724846785919a7a0824b5709014af0cdaff70f62d7518dbdd712015a890937

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Logger.dll
                    Filesize

                    28KB

                    MD5

                    c8508a8572731ab5ad12642fb866cf20

                    SHA1

                    1d919365597a4e6799dec2308686391bd378f484

                    SHA256

                    e7a9d37812c43e9d557f509f1d240bc3d3b0732d2b951606e0260a7de66130e3

                    SHA512

                    8c22c9a0cac8c2d3675d553c1cc3ab504005f759346801c98e795de4eb89667d8c9cf76417e60740a15b5a5b745485136d99ecc7c582294d12adad227265ecab

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Miscellaneous.dll
                    Filesize

                    82KB

                    MD5

                    d7d72ad5575c1b8ad9b6c170ca2ba53b

                    SHA1

                    51e0d8f952f22a29f92c2c37dacebc8b46e9cc4e

                    SHA256

                    329937d550d1f28c77dc26c45b97dd701565a58d1f60f7e3a35790c4cf87b9d7

                    SHA512

                    4838176ee94e1d7643eecbae46dd57bb7d8c264ec127ff0b4443186893c17854158d1576645bf2a7d5bff3f2cb5e91a5c5242e5f236b6ed8c2e18f1ecaf2d1e5

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Netstat.dll
                    Filesize

                    25KB

                    MD5

                    016439dfdeab850df3845ec000f48eeb

                    SHA1

                    84d88f7ddd216365aae2f44806caf1f52427309d

                    SHA256

                    e06ec5cfd60b3312796135820cba9d230a780aef97fdc0f8da6207e8c8e5e000

                    SHA512

                    c671c70f25883e5cb25266628947f3c04d7054fb916ac72c39a759b4ec15e3b51008604b3554779a8dd25ab318ae369980e9a5cead22fa88151350cf153e32c0

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Options.dll
                    Filesize

                    378KB

                    MD5

                    6d598f254cd76db5b465d8a5d6244c96

                    SHA1

                    a8b716c7bdab3b5ddba5f06d66462cde2654d961

                    SHA256

                    759453183cb7b6e64ff834b3f6643fd5e8b8f2ee826d662871ad417097bc16af

                    SHA512

                    8de61efac210139fe8839be69772ffdb83e8913ed26c3fbc93270f3ec3270b1ba392d5612416459aa7563957f663669248b15a773dbe6696746827d0b8076597

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\ProcessManager.dll
                    Filesize

                    25KB

                    MD5

                    85ad68e55dfe03e679b650e2a689b905

                    SHA1

                    172c79f1006223e130e63ff7370d9dda01c3a87f

                    SHA256

                    d664a79caa45f63a3729c25859eeaf11d7692866c9438316ff3443b754c9d86c

                    SHA512

                    672cc61423b79b96cfb97ca83ec9f379666fbb9003c6105d170b89d7da85da443d064624421de4da6112746d240d709f7af7a696b64be8fafaaf83c8402ea0df

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Recovery.dll
                    Filesize

                    1.1MB

                    MD5

                    cdb0f455ed9d8243479d84930016b594

                    SHA1

                    e49842ddd267c8f0731090f56c16878564a1c196

                    SHA256

                    bea19e2dece602ced1d3df8c825a993f3d412c2a4d4d87eaa39f44ba4fb39e82

                    SHA512

                    ba5bab867d6ae8a20c9c20f9203a3cb348a0cfa411a2f03b05c698b4b7b569b31a037b72a285c2725330a10ab02532dcdb904941531839f03ed01a941f457825

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Regedit.dll
                    Filesize

                    280KB

                    MD5

                    1311db472a7d6214c081d1570ce26cec

                    SHA1

                    97c69429b40f5413092522a8b9277e89ee9ad0d7

                    SHA256

                    c9db48c701d11ccea315e72da8482e1b00ea5472c1235f6b4e21bfff73b2e941

                    SHA512

                    2e7c7e9403b4e93f5047a08b5b9f0d017884840d0473f9def1b0ec23173b7dea697a4a02ed6b3e8e09a3129151385b9b3ec5c2da8793be908151f125e7114deb

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\RemoteCamera.dll
                    Filesize

                    107KB

                    MD5

                    0c856c12a57ec760d42beb7c7aa9f654

                    SHA1

                    fb2344188d90ae256782cdf3814e8cb2d82353bb

                    SHA256

                    083b7be903110cbe07e367df7f1ccf0283fb25a3561969dadca319c5ee580865

                    SHA512

                    cecea1ae8a904d54a9841ba043708668bf98b904a7b1e5ca096efed04f2e1e88b713e2f43b5021033c74481e3052b641553f5bd1df2898c3feb26d43adc457be

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\RemoteDesktop.dll
                    Filesize

                    34KB

                    MD5

                    7ce57602a56e0c140569e80e6bdca112

                    SHA1

                    66efe692b9a866c29eafd5f49f9b87ddf30e249c

                    SHA256

                    82bcf176d913f0776418319f42dc5d04ed32e1fa7228cc3802d41e62b5147256

                    SHA512

                    5b422783c8971a8ccaf4fcab6fc5e3f494bc74d575b57d209c5c826f8438a73480bbe178d13cc7ce66036ac9b5fd7b033d8f811436e7f88a9b49785e343ac8fd

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\ReverseProxy.dll
                    Filesize

                    553KB

                    MD5

                    d560dc1d671c9f63341eaa2e82e8da3e

                    SHA1

                    f4a241eb751c8bedb329db709addc799481d7347

                    SHA256

                    839728b1c09a00907e3efc67de957600c59d6a03afc8f8880160e9ede8ed93a0

                    SHA512

                    1f3730857c918ab8aabb8beeca48d1be2db05d78f105f1fcbd156aff04068492d75b995af92f639e5944859f73a8c6aa9302749f9d0c361f0523b25f69b433bc

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\SendFile.dll
                    Filesize

                    26KB

                    MD5

                    7b93b63734901d7a5c40e06c6706c1e7

                    SHA1

                    3c534fbfade38a1f1b90ce463cdef404c1330234

                    SHA256

                    54c537118656e6c56c55e5894d5798cf4ed495ba7992b46050649ff660dfe7d5

                    SHA512

                    7711ea2c15dcaa0503e5fe92ee9f03af32d8ed37dc5ea4a40c46e77ab65ecf0321dad1ad11b73845d7dc94ca6f261769d4dafd538abb4be0d70a0a2153fb4a32

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\SendMemory.dll
                    Filesize

                    28KB

                    MD5

                    afb9b0c9bb59fb128406ae3f9fb71c78

                    SHA1

                    820c24c6a252639f6d92130a4a6c83db53f8f3e7

                    SHA256

                    d179e1d3e1f46c85bb4a03e9c9069e8b529999e776b7b12c2d4a47f622535f8c

                    SHA512

                    23102da3a25695c45a20f6bcf8ae82d58b00a92c359db9de5ff1584775fc521ef46ee9468032cd771afd87c035e2181c3d15072de1738ea0665e39294c638f80

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\Stealer.dll.config
                    Filesize

                    1KB

                    MD5

                    ee37d8dde7f969b007430b18386ef45f

                    SHA1

                    5dadec5c0ef36d2511d9e4943ea5a59462a657ab

                    SHA256

                    63837bde3bfb609d59002b88831786e7b0bf285a6090f9252c35af9ee3f75ff6

                    SHA512

                    76bde199f18744451eca542084de6819c1033bd28495c5a458be242bc00b4b05027de6358965c2357772216ec7afa55ef459ebe7b9e48bc5bd8baa60ba1f9d21

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\ip2region.db
                    Filesize

                    8.9MB

                    MD5

                    c8f4c82b2cbe02d7797dd6568533ae5a

                    SHA1

                    92893bf95436d087b55ad3bc1ab6b8a349adc2d3

                    SHA256

                    5948907df4a4782d5954499b65ab011e257fc5775f81e0b8b4dea6fa10e6fcc5

                    SHA512

                    151ef56eb99cd29e02dd04b2dc19284597df2feedba1e1fbb6bbdf65f5f66fd2f9caffc48057ac1cb684270739ecddff6098b9b97b80ecfb98e277917f174c96

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\x64\SQLite.Interop.dll
                    Filesize

                    1.7MB

                    MD5

                    c2d9e689c9b7dbfbd6266430fcce1add

                    SHA1

                    1ce680f48d19ab31f4af39c261451804a2858a11

                    SHA256

                    7bf956ba8edbc7358398707afddafa3acfcb212796f4169130d7cfa557653e67

                    SHA512

                    24867f191cb91e1a6dc7dbcfba02881dcb9bf49166315508bcfd331f51495a536431d33b5444fcfd270adf6def4691301c17c328cd8ef779819429437f590e08

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Plugins\x86\SQLite.Interop.dll
                    Filesize

                    1.3MB

                    MD5

                    730e57d00a8699352cfb15ec1159afd0

                    SHA1

                    3ce30190d1f64dcb4572f0dd0efc065d58407dd9

                    SHA256

                    29f4c07e9c5b265976967d8afe435b0e74bb6169c20090d856fbcc42a4bf48f0

                    SHA512

                    b5bbc861884d4ce0a0846688d493f7a84b97076849ab81fdf3631a525dd99a12c7156a9d43b3019f91a912ab102669b651c5f6c2967142c29d2b41e76aefd3df

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Resources.resx
                    Filesize

                    17.1MB

                    MD5

                    f5881e9cf9d84fc36268f71a8f496c6a

                    SHA1

                    4e12b92b28cbfd4895da48a71f82a4848b926613

                    SHA256

                    b00bb37106f449417db0d3d9e4e73d35755e89fa9ce94582b74612bad93cecce

                    SHA512

                    0bce7d6e7a210744ff254ebdd6f792f85cd31c11a07d0581ff8c8722011d73a542b23e89dd628f3c1a19988ad145064af7a45acf0193f0a9c44d9bab0a81951d

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\SMDiagnostics.dll
                    Filesize

                    118KB

                    MD5

                    2612a0586acb1b3e7b5c13aad79504fe

                    SHA1

                    8a8ac9ce4b3a174f46b69fd16bad04c5f3044e24

                    SHA256

                    e7c76c52a3e9f751ed6ed9c9231e35228a636ebd68726241a843f31c5a41ec0c

                    SHA512

                    fb6d49a3c5051c12a9bdc23f5d0b0450cada30b54fc557e83b55280a5ccefe00a30f9a641c65bca42f2cc1eed30ada4eabd07e97814df715f1ce9b2f046aefce

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Server.Properties.Resources.resources
                    Filesize

                    11.6MB

                    MD5

                    24bb6bf569b7b8b8b2743f1b4ec138d9

                    SHA1

                    0ee96dead026dad2413cad1729c44da82e9aa0a8

                    SHA256

                    db0da3c4c367aa05193b918d91fc731ccdec0241532b02f544891547bac61976

                    SHA512

                    6dc0ed583a468ae2e649e6abca910f4f58ff7f0d3f0cf42effaf33b276ec520a2e6d37cd3a702a86265e537fdd570fcca5bd55cc049c8a7396ebee895101b71d

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\System.IO.Compression.dll
                    Filesize

                    65KB

                    MD5

                    24e74963a68d66fcfae334d91f5c5b33

                    SHA1

                    c0cf3df19033cdc055c627867795d8e458a67ccc

                    SHA256

                    10a7c576a8bc639b63b9a1c6b5f8d38f85e34b3f020106b27076d395ac3d82be

                    SHA512

                    6d28dd711ab97924a2e807d7df61dece98df9f262b55093e5d58117740316dfba33d329a3e75662aeed5c396e8a67afe62a099f5e6887ed23cd0d082718fe7ac

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\System.ServiceModel.Internals.dll
                    Filesize

                    804KB

                    MD5

                    7f35e0251f45807e872ee0a354a8fe81

                    SHA1

                    74cebb21cb95165774ea0ab082cb85cd3458ca8d

                    SHA256

                    805d9e2c5cd2f2b17e68763ae4eb1db0103bd278e526de32f98e0cd336541e14

                    SHA512

                    c5dfd9e43295b786eae9869ac1ede564d9d86255a58b3cf2f9af313c355fab8d5c3c4bd41291da65729ae510000446290588e9d67b2e65aa6da10777c6f5d38b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\Vestris.ResourceLib.dll
                    Filesize

                    76KB

                    MD5

                    944ce5123c94c66a50376e7b37e3a6a6

                    SHA1

                    a1936ac79c987a5ba47ca3d023f740401f73529b

                    SHA256

                    7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a

                    SHA512

                    4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\offline
                    Filesize

                    86KB

                    MD5

                    829c84c8f69856aaba8dfad042bc1cf4

                    SHA1

                    0c9e6169aa58542e60807405d12ac226888c282c

                    SHA256

                    21b4173439bdcb6338d99a8f060b98426cca95b2830b62965a72c94bc6c77236

                    SHA512

                    9a670fa71f795efe96bd61cad7e731ef9300e93c44b8109f89678b7db10bfebe386e694cdba28047c837d907ae73090252900ec0b315aa74509f826b3cf403ce

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\7zE0C8B9788\Aurora-Stealer-main\online
                    Filesize

                    88KB

                    MD5

                    4e642f0d041d6ef79d7701e599e4bbe9

                    SHA1

                    e82bf57ee1d78070506d08b16d79991ae2b069c0

                    SHA256

                    c2cfbabf111d231fb2531b6c0759c5191fd91f767059790ff53aef87fab2280f

                    SHA512

                    79064943187cf61fadfc315986c71cc500e21ee1f8b9e81c6978f4ae555fe492153ca7c727935004fd5b2f90b30f2c1d15bcc95cc25044e861e1309fdf4b4ca1

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
                    Filesize

                    8B

                    MD5

                    cf759e4c5f14fe3eec41b87ed756cea8

                    SHA1

                    c27c796bb3c2fac929359563676f4ba1ffada1f5

                    SHA256

                    c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

                    SHA512

                    c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

                    Download Submit

                  • memory/756-190-0x00000000006B0000-0x0000000000706000-memory.dmp

                    Filesize

                    344KB

                    Download

                  • memory/4312-193-0x00000000005D0000-0x0000000000626000-memory.dmp

                    Filesize

                    344KB

                    Download

                  • memory/4312-194-0x00000000057F0000-0x0000000005D96000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/4312-195-0x0000000004FD0000-0x0000000005036000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/4440-184-0x0000000000530000-0x0000000000584000-memory.dmp

                    Filesize

                    336KB

                    Download

                  • memory/4708-196-0x000001F5E0380000-0x000001F5E0381000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4708-198-0x000001F5E0380000-0x000001F5E0381000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4708-197-0x000001F5E0380000-0x000001F5E0381000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4708-208-0x000001F5E0380000-0x000001F5E0381000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4708-207-0x000001F5E0380000-0x000001F5E0381000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4708-206-0x000001F5E0380000-0x000001F5E0381000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4708-205-0x000001F5E0380000-0x000001F5E0381000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4708-204-0x000001F5E0380000-0x000001F5E0381000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4708-203-0x000001F5E0380000-0x000001F5E0381000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4708-202-0x000001F5E0380000-0x000001F5E0381000-memory.dmp

                    Filesize

                    4KB

                    Download