aurotun | ff6ba4489c2fe94e5ed49e2bbb411abbb6677f73b56df746ffb36c6c0ea6b81f

General

Target
ff6ba4489c2fe94e5ed49e2bbb411abbb6677f73b56df746ffb36c6c0ea6b81f.exe
Size 15.6MB
Sample260630-e311xsew2z
SHA256 ff6ba4489c2fe94e5ed49e2bbb411abbb6677f73b56df746ffb36c6c0ea6b81f
MD5 916a92fecce7add34f036ded4aa56f27
SHA1 e52be4cc6163f2a4886cd4386e169b2d0ee18d87
SHA512 dd40b6df98dbb5202c5a7b2f5a7a8484928f97ee34cce8d1ec2245cd02857b7fd55c8dbd1a53352d0041cdbba11e8d89b4ae9e26725509ee384c17c85a1caa3e
SSDEEP 393216:UpheUVEJmFbXNEKuBplQHAR2MardbL6Ser7M58MLo7VAa5:UptRbXKKuBplQG2fZbL6SaM5eR5
TLSH
T111F63331E5904126E6F142B7FD2891307E39A7241B618D6BE6D8DD4E3AFC88127FB217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%ALLUSERSPROFILE%\mpupdatev4
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Extracted

Family

aurotun

Campaign

site

C2

103.119.47.218:45654

Attributes

anti_dbg
false
anti_sandbox
false
aurotun
false
disable_mutex
false
kx_pk
O1qYj92amgLh+Zlh+n0X/L2FaAYYU5DkKSQ82p0yMgc=
priviledge_escalation
false
seal_pk
15Zp79IXWmyblCGUpLeGly9DzrqI4I0QgkJdwypB/EQ=
sign_pk
rIMQ4f5yziHEzFPnN5Ty4zBAH7Q+Kso2bzWsVIVBp28=

Targets

- Target
  ff6ba4489c2fe94e5ed49e2bbb411abbb6677f73b56df746ffb36c6c0ea6b81f.exe
- Size 15.6MB
- SHA256 ff6ba4489c2fe94e5ed49e2bbb411abbb6677f73b56df746ffb36c6c0ea6b81f
- MD5 916a92fecce7add34f036ded4aa56f27
- SHA1 e52be4cc6163f2a4886cd4386e169b2d0ee18d87
- SHA512 dd40b6df98dbb5202c5a7b2f5a7a8484928f97ee34cce8d1ec2245cd02857b7fd55c8dbd1a53352d0041cdbba11e8d89b4ae9e26725509ee384c17c85a1caa3e
- SSDEEP 393216:UpheUVEJmFbXNEKuBplQHAR2MardbL6Ser7M58MLo7VAa5:UptRbXKKuBplQG2fZbL6SaM5eR5
- TLSH
  T111F63331E5904126E6F142B7FD2891307E39A7241B618D6BE6D8DD4E3AFC88127FB217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

site discovery aurotun hijackloader loader stealer
- Detects Aurotun stealer
- Detects HijackLoader (aka IDAT Loader)
- Family: Aurotun
  Aurotun is a stealer written in C++.
  stealer aurotun
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Detects Aurotun stealer

Detects HijackLoader (aka IDAT Loader)

Family: Aurotun

Family: HijackLoader, IDAT loader, Ghostulse,

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2