aurora | 2024-12-02_5785fef04def8b022e41f99013ba0239_frostygoop_luca-stealer_snatch | Triage

Sharing

General

Target

2024-12-02_5785fef04def8b022e41f99013ba0239_frostygoop_luca-stealer_snatch
Size

50.0MB
MD5

5785fef04def8b022e41f99013ba0239
SHA1

c05183b91b946bf7447e8b0599e62acf44de5f22
SHA256

19ebdb86b466fe3027a4a640b1076875d48b5c79a0c34353ef82d097e46932b6
SHA512

4f00277ce6afcb0a931daffc1789964d9596ed42cb71b51708a14f75c8215bfee49217dc4c13d542a7c2b56c6a8414cb21d9bee4c9af9417bc976d76754b2798
SSDEEP

49152:bL3cO9ce2dDTuCCpr7HFHTAWJeaksL6M8dS148k1:B/2Bor7lHnLd8M

Score

10^/10

aurora

Malware Config

Signatures

Aurora family
aurora

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-12-02_5785fef04def8b022e41f99013ba0239_frostygoop_luca-stealer_snatch

Files

2024-12-02_5785fef04def8b022e41f99013ba0239_frostygoop_luca-stealer_snatch
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 224KB - Virtual size: 610KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ