hxxp://aura[.] | Triage™

General

Target
http://aura.
Sample260531-vb1tvafs8q

Score

8^/10

Malware Config

Targets

- Target
  http://aura.
Score

8^/10

discovery motw phishing
- Contacts a large (648) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Declares services with permission to bind to the system
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Requests dangerous framework permissions
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts a large (648) amount of remote hosts

Declares services with permission to bind to the system

Mark of the Web detected: This indicates that the page was originally saved or cloned.

Requests dangerous framework permissions

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks

static1

urlscan1

behavioral1