Overview

overview

10

Static

static

10

sample.exe

windows11-21h2-x64

10

Resubmissions

20/04/2026, 16:09

260420-tl758sat4r10

15/04/2026, 15:19

260415-sqh68sdy2v10

Sharing

Copy URL Twitter E-mail

General

  • Target
    sample.exe
  • Size 16.0MB
  • Sample260420-tl758sat4r
  • SHA256 d9ca878417879125a0aff7c605c423ff6db0332df74e0935a26fa02a041e3d7e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
aurotunmonsterdeinstallerpersistencestealersuricata

Malware Config

Extracted

Family

  • aurotun

Campaign

  • DE

C2

  • 194.55.137.65:80

Attributes
  • anti_dbg

    false

  • anti_sandbox

    false

  • aurotun

    true

  • disable_mutex

    true

  • kx_pk

    kaeCu/FlhgyGlailxRBQpeHBwLF8zuP5mPiuqG+WyH4=

  • priviledge_escalation

    false

  • seal_pk

    ufKf4ZjUH+YIbH81p9b0/8OtD1tQ4xMvKzLVFyiHqA8=

  • sign_pk

    LV3K9rOboiVW8ioy2uNgNwf9+ELcBSKd5vWDQXDWLnU=

Targets

    • Target
      sample.exe
    • Size 16.0MB
    • SHA256 d9ca878417879125a0aff7c605c423ff6db0332df74e0935a26fa02a041e3d7e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    monsterpersistencestealersuricata

    • Family: Monster

      Monster is a Golang stealer that was discovered in 2024.

      stealermonster

    • Suricata alert: MonsterV2 Stealer Malware Outbound C2 Communication

      Network activity triggered a Suricata alert

      suricatamonster

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks