Extracted

• • Target

    Aurora.exe

  • Size

    25.5MB

  • MD5

    ee0a49caa656fe8693ffec78e69e864d

  • SHA1

    dca409540b8c19a31e0748a17425835358a90e1b

  • SHA256

    34e038a53f367feda9eb1ffbf71ca6af8ac9ace7a34d86c43e1f197c8988057f

  • SHA512

    897be9ce27bec144b34cdfc4ef94cd95c2cb58a50e4679f9c3a2fa2df42c0a9dea80b4fcb7fb4fd037278cab427abaaae553e1939bff83868e15fffd3fdf3aa1

  • SSDEEP

    98304:SlQKxQh+98myGsy1slENtrE7pQ8kq34vEStCAsDrP7J8yStyBCWLRV7VtC4bksxz:OQPY9mgGvkHEAsdtLRVRXgFqKQbEZxRO

  Score

  10^/10

  auroradefense_evasiondiscoverystealer

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora

  • Aurora family

    aurora

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1