eb838de34a5483a090372ce46b6a9d6770d20e7f4660002f1bad9f795ed53047

Sharing

Copy URL Twitter E-mail

General

Target
Aurora.zip
Size 67.5MB
Sample260628-s2de5aas3l
SHA256 eb838de34a5483a090372ce46b6a9d6770d20e7f4660002f1bad9f795ed53047
MD5 a94d7802262d845d7f1d0db762a78fef
SHA1 953365b8a1e2f58203fb380454c5c602d8fc69fe
SHA512 61afd6e963e435e93daf39efb87cddfe4d32ac1b055f4846a9541543e42babe5fa73b8a3a9150256f6a9a4fe314e4c0ec5c6b57851fa4d8f2e958be603c3743d
SSDEEP 1572864:5QBjofY2ZYwer8Jw1ZlDma1R5gOJQ+9jQEjJrHzvadqC:5QBcNZ0YJw17z/5gOq+9jNRLI
TLSH
T13FF7334CCD978CBDE8DE223149D585BEFD152B0E6BE44887DD60B0DC1DCAE864B325A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Aurora.exe
- Size 90.4MB
- SHA256 111d90d75a545e2507804a856980d0cfe8b840baf53bc1cd398469f38aa31b91
- MD5 a575fa402cc86594f8fc15f4ad61bbd2
- SHA1 16a95e94b851288a51cdec3b29443321ca68fffd
- SHA512 8592a9dd28489e208c30e815cd6b4c849fb17ca2ff3dd99a6cb8081c8bd04247cbc658ab590b1ca94a2abcd4e846f35726d464a56a07d4f167413abd2c054ecb
- SSDEEP 786432:eeQtp1aUgmGRixuSPZBcZnlUy/AhUk2Ha1woZwt6pYVP8ex4TyzlP:atp1aZJCBeZnW11wZiEP
- TLSH
  T1FF289D06B3536D62F0179635CE2A8773E6307F71A134825F26ADF30D5FBF6508A6AA10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Bootstrapper.dll
- Size 86KB
- SHA256 b64256f969d050503fffb72bae9b5ebb914ac5bae6111b49e3065a4cb19360a8
- MD5 7565e0076ec9a629041e049cb4a6355f
- SHA1 7ca06a5b2539a6e71f23145f53284b29b5c7435a
- SHA512 d348794948ff45b25c822186009724cd2f5d5e38860541731e39c40457ee1fa2fa6439b6f7d27a0b99f60da25723f3fc1f67e6f809e38ee230af4c72dde1c405
- SSDEEP 1536:MwL+aOk+zAtmRp0Ky7Hxcvu6Y0fuZZRKsW1cdbyUNp8YLP5S:XOTUtS0Ky7uu6Y0fujRrbyUD8YLs
- TLSH
  T187837D0176D1D871EA7E693564A0E9616B7DB9124DE0CC67378A023E4F703C09B35E7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Bootstrapper64.dll
- Size 101KB
- SHA256 dfa2ec1d3eed49c1e195fd70268d2e7224dea989f55c7fa278e7123a58b26dac
- MD5 898cf51393da8ffe4575002deaed8fd3
- SHA1 5fa48ab27943bad6b9ff3f95f18c2cde15532217
- SHA512 f642dc9869c8e7aff4df4e55b4276d46cee83c7e01054e18da90f67f1c1e8d004e886eef8040d9598b8a57e74e280861d2531791c878c78b7309be9a3bbf0a1d
- SSDEEP 3072:geJ6d+yI/UtPQQZaBZWm5W7BLBdM5/b65knsMPM1pRD1vQ:/ocQYBomuDJQ
- TLSH
  T108A36C5663F404BBE4334A38C9A39E09E776F8510A619F6F03A4429E1F673D15E3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  CHDotnetCoreHelper.dll
- Size 17KB
- SHA256 db6347c17388dea9667cdd90f2f0706ccbb19d9cb470810e1ba12ff234908404
- MD5 0929258602f21b6fdaa137f9ec42a9d6
- SHA1 7f86d2f281061932f9722fa76f246488bd3e548a
- SHA512 0006526e91d21c5638139b97bb7ce36a067d34b4d0c546cc12818c18d5d76261d815b068487e714181aa50afbe1c559a50a4bb4e0f7b242284c40819d2a6b631
- SSDEEP 384:XpG86iPJ7jKMFF33dfNx6u9GycxRe99vkPROQyvMaDLan:ZjvV3RGycxRy1vMaDG
- TLSH
  T15082F90D9FECC677CABF46BC68F226499271C168B453E78E5CACF69B284134149C1723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  CHDotnetHelper.dll
- Size 11KB
- SHA256 8fadcf52d1b5c7f55ade42177f22c0dd39d796cb317cc91b8c5a077c9f6eab44
- MD5 03724f3259ccff60cba459cd373e7f5f
- SHA1 376c7515bf0eb5c79db4bcdb68d62ba027dabd32
- SHA512 1d5a50cf7af0dcf5dc4e9814c5a220bc0dfa7e8f8f0c3ff710f6c1352060667ac209e94e7e41260d68bbe34e99f17f448234a6c3fd2ba1df9622014402ac9cb6
- SSDEEP 192:lu90dyq7EcZXKmnhJRhcpm3E7VIE4wSKglE:lA0dyq7EcZHJRSpmIqKgm
- TLSH
  T1EE32C60D2B96473BD96D4E38E9A2128013B9E5137653FE2FCFC4B40B28522594A63FF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  CHMT.dll
- Size 479KB
- SHA256 ec4fb0b973cad2bd6519828ddb8e0ab3243a99ced6a3a002c642b343d80b2711
- MD5 14ddae1fc1f0a5a6afa730a5642587d3
- SHA1 a7ae15f86011b7c7899c6ebedbc33a8780947209
- SHA512 ba733758094f18ebb8a7eeaad123fe323f225a0ca37ec6d8bc5fca052f12148b58917b4ef66198cc93e70a917b5197b6ec710b4a4734fe815484baa5f402cc76
- SSDEEP 12288:qHUUxoP/9H1KXsguphyCAOFyGCrK0KtgC8TvMVrpS9x2GJTaQu:q00tOs9B7C8TvMQ7ep
- TLSH
  T1FAA4AE1075408233E59E907015ACEBBBA53C59314F64A4CBA3E4EEBE66B42D39739F13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11 behavioral12
- Target
  CHMT64.dll
- Size 559KB
- SHA256 e4917ed9c9ed1b9e3c48bea2e39783f61e5bb856bb37f522e8556c7dc7de3975
- MD5 905bcc017e762f22f4f4e1f1be18c3c5
- SHA1 14cb10ce3227f7025354ec527b306dcf77c62b50
- SHA512 0b92aedd619980ddc193ab8c44fb3fc80dc706cb800a9f1c0b021141475dac1a95619490f568ca7d220505717c2301e50e551fc440c881be8e44771476b94f71
- SSDEEP 12288:J3IiTjmOX1l6AmOLWORehX6qo+nV/HH1KzQyYQQ+oDfcuPXApbU5I6bM00L8vWdI:wQhURbFk8es5GgSVG
- TLSH
  T1E2C47D35B2AC52A9E567E17888D7410BE7B17846137156CB93909DAF1F2B7F02B3F220
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral13 behavioral14
- Target
  CUESDK_2015.dll
- Size 253KB
- SHA256 ca240a548e2d16e6f109afa93aefa880dbc4e865789c081a1798e25ff1c24c31
- MD5 bff89fbe37480087e59626e468aeb919
- SHA1 c9ac53dcac4df82cdcc275cd7f426f25019a765a
- SHA512 94bb598f539fad62876ee7957041f651aa65a188ba83549129ecd90fac4d69531479a8a3209859a4ad6914c772a6caf495b326b36886919dbd7c38908e93f789
- SSDEEP 3072:BqH/hvT8iSMWozBu5vX/u1gdN7mA58zw9GT:BsJ8iyoNu5PE5SGT
- TLSH
  T1F144172A3B648D62D56791BD8983CA49F7727C104FB1DBCB2185932F0F33AE59D3A121
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  CheatHappensOverlay_x64.dll
- Size 2.3MB
- SHA256 59a415a9fa4cca154416ae67f584b547071c6d93408fad76aee3380b45ac4560
- MD5 ae58155d8865ba90391436fc9fca7c24
- SHA1 370e7ce5ffc4f08cef6455963bc715aea43f5649
- SHA512 8583c04437e17e306f42107af063956538cf7218751c9fdd9b1a916c84c381b01bff60e7b41a5404e04f3f3ac498d98175322abb125c8d7c339148eb8ae19894
- SSDEEP 49152:GFqcyoYukQ828002nZEbapTL2iKeRpJ6iar9Fl:GFqskQtztL2itpHaZFl
- TLSH
  T18BB58C07F2E242E9E1BAD3348573262BF93138609B3567DF679426591F727E0A93E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  CheatHappensOverlay_x86.dll
- Size 2.0MB
- SHA256 fdf5d8b4cd6221371559397273273f7cc165fff9d6c1a83e0e9d19a7ac3d0639
- MD5 c92f3ec29fca58b36172983d36f7b034
- SHA1 0f236c354e7ee01d18fb1c2bdf50f6ea009133e3
- SHA512 1f0c54b968f206f973e805442a976a43bd688384bf69ec2bee421e2bdbacd27e26883f9e6da20c1561c34b6af1c3fb71d3ae1fca85e89043858d860cd28496ca
- SSDEEP 49152:zBsb2KlTGamhCza3XapTL2iKeRpJ6iar9FFmDc:dsye9tL2itpHaZFcw
- TLSH
  T1E4A5AD02F691C129E56903B0857F275F643C29B0AF2541CFA3D83AF89FA13E16DB5792
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  CheatHappensVulkanLayer_x64.dll
- Size 183KB
- SHA256 683ebd07476973092645dd92573cbd42bb53c9cb092902dcfde0dc89d392702e
- MD5 5e22534a18515f56a2a0a11bfae95bde
- SHA1 839b19d7945b766ae362b744172b2b91d383e8fb
- SHA512 e0f2701f399432b2e1b1739ca61e95fb834c73d58729f1482ec4fa673a35b9abf586b6b2e956e9209cd12aeef6d8a2bbd7f58483f3c0b92ff590eab9fafc7f36
- SSDEEP 3072:xkLPIE+GLggaihb0k14TNbOevzoppQD10FOLzENrNJqaqQfUsv:xbE+GUSR145bOev8lv
- TLSH
  T11E047D47B7B400BBE9739278C9A31946E772781507609BDF03A0437AAF2B7D0993E725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  DotnetCore.Bootstrapper.dll
- Size 276KB
- SHA256 39ec7848fc7a709862f3630599b610db8e0192b71f1551c70287b03d40ef6a2f
- MD5 fe1bff707bbff8da531e6859a2667055
- SHA1 c1c9097d3b9ff82497fb49cbe26692c4e4cdcb8a
- SHA512 0a454c3dc33f4f60ae871ecb9e266dd480db5249f56de5b64a794f4e2c2365aa71e9f783d39082a6c94cc76c88738589c976a685d37a2caeceda31824e1f5758
- SSDEEP 6144:wH/0PRMUv+ljCuNcmYLDndFKDnej8kLRC7:zXmAgneoK
- TLSH
  T1C5546C16A7A814BAF1B7953DCD934906EBF2BC4547B0D6CF13A049A61E337E0863E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  LogitechLedEnginesWrapper.dll
- Size 19KB
- SHA256 46a0773e5ae6ef5b24557f3051e18a62527c7b2c133360dfb21522cbfe9cbdd1
- MD5 05234eef1d96d26f84e639fbbd0889a2
- SHA1 89cbd55d54b08d4b8c22150d509d3bfb1dd0d4c6
- SHA512 8835be6bb4986ef1010a9bd45cda19ca6a261c5e9041805956cf6de4e8e203684b050c21839e032f21871f4393304c3875aeb1f7b00a831f233df98efeddad08
- SSDEEP 192:BGeSN0Ym3DpniiAYp6Ft8uiwsfTRfGKI1up3Xcz4jQAbauZLWwsUJZscF8Bd1LPz:gCoiAPwGr1qs6QAaSZsHLPK6jzJQHPo
- TLSH
  T1AB9219579BC40805FDBA4A34F8F4482BA9317329A734D9DF7520C0286FE7BC56A78791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  SDL2.dll
- Size 1.5MB
- SHA256 b37740a72a7a9706216df9f0134894bb7a850b356fd149398c67d874cbcfacb4
- MD5 34f609d1d268b45375488132be61e858
- SHA1 42c3057e68c8546df6c902155781bb1f7b808c11
- SHA512 105ea5439ec87943b78ccd6920977c8212d93fc740828f14e428618a6db4e425b3126a64f0c6dd434a76c4e6d4781d11ca0af4201808ea00644fd5824399438b
- SSDEEP 24576:SWnSPN8EL05SuQZ7MDFKTQ6G/BqBE3iQBt30o2Thzp:SOSmEL05xQZoIG/BUE3H30o
- TLSH
  T196759D4FB3B605A9C92740BAC287761BD376740827D15BDF2B540BEA2E33BE4157A360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  SteamdeckHelper.exe
- Size 2.5MB
- SHA256 0eca36e72996141af69a5bf4f674363e41d872149c28d116f182ad0fe25c3d37
- MD5 67acfb049e48b545b193bd38fce0a84a
- SHA1 e1a148a9dcb658897469a455c175faf5ae7d03fe
- SHA512 54af3ebf81be5662eabfb5c922f019419a8739c845302a1a8e924fe5f6e55e20ddfeccba58de0eff5d0c5a41ed1136976e7f9304a40aa0aa0fc141ffe91637f9
- SSDEEP 49152:xj0tbS7X5B33q4Kx8m8zH4Srq1A21Ntn183T5nIRVbDCiF1FWIW6p:10qB33lKeH9q1rbt18FSDCiF18IW6
- TLSH
  T10EC5CE01EAD19AB2D0B7163004B9F771977DBE1246325E8B36A8F61D0DB06E19B6F313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  Updater.exe
- Size 33.9MB
- SHA256 c384e26e4cb67b0977afa9bb0d6053e384440f5975d6061a6de61e72b22ea0ee
- MD5 898e5f6fb9f4a28ac73b4dc1c8a58237
- SHA1 8f051fb289c153097d48d4fc561baff78cd41004
- SHA512 eb888695d91a9498735fd1fa898af0b78b567a01d269d286143a5bcb9fbb8ef85a3887ab7fcb8a22312990291a9488b3edd4cb397e0f7b48f0c0452e322d5482
- SSDEEP 393216:Jag5abQzBGITFBuWHTEjor16b1SEQmUWU1xVWwXEIEaZ/DatU3x:NMs26190zaZ/DatU3x
- TLSH
  T130777B26B3554EE4F027C034CB96D633DBB1B8B5072492CB1255E62A2F7F6E01E7B624
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32