General
- Target niggainmybutthole.zip
- Size 24.2MB
- Sample260702-asg3vaav2z
- SHA256 49dce1e441129f44034eb94143df788c874da685cb8f3c6bbfbbf471531dd840
Malware Config
Targets
-
- Target niggainmybutthole.zip
- Size 24.2MB
- SHA256 49dce1e441129f44034eb94143df788c874da685cb8f3c6bbfbbf471531dd840
Score1/10 -
- Target Aurora/Aurora/AuroraClient.deps.json
- Size 11KB
- SHA256 1efac287ae688b80a2f1e51dd457bfd33b8505c600f193f5cfa05cc4109f645f
Score3/10 -
- Target Aurora/Aurora/AuroraClient.dll
- Size 21KB
- SHA256 4cdf9603b52036b9689b7c368fc0ed98f41e3fc7f1baf66e904938db3692a614
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Aurora/Aurora/AuroraClient.exe
- Size 374KB
- SHA256 e694f26b249050dc0001e48911c1381ebe9308a85e86afce1699d730eaac7b77
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target Aurora/Aurora/AuroraClient.pdb
- Size 15KB
- SHA256 17e667c23d7d4add501e2081daa18a1ebd67a62fefd7c420305f03fe02356b2f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Aurora/Aurora/AuroraClient.runtimeconfig.json
- Size 443B
- SHA256 7e79af92820e50910b90f1cade2728f45987393f24b50e384dc225d9773b7194
Score3/10 -
- Target Aurora/Aurora/CuoreUI.dll
- Size 288KB
- SHA256 2a9d8aa819fff823dce4158c3619c034a938296bea26904d08ce864bbcd9edca
Score1/10 -
- Target Aurora/Aurora/Microsoft.AspNetCore.Cryptography.Internal.dll
- Size 44KB
- SHA256 00cf84ee76c029cded8104ff0fa4bad1c5b482b88dab4abedebf54df63aa2800
Score1/10 -
- Target Aurora/Aurora/Microsoft.AspNetCore.Cryptography.KeyDerivation.dll
- Size 25KB
- SHA256 d52ab4b3d6de3ab36eac092dd2666bce2587668db52aad6419c699ee6c496db3
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Aurora/Aurora/Newtonsoft.Json.dll
- Size 695KB
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
Score1/10 -
- Target Aurora/Aurora/QRCoder.dll
- Size 152KB
- SHA256 dab588acc9f280f289f6348fcc6388fd0c2eed932069cac9ae2d7fdb15076c43
Score1/10 -
- Target Aurora/Aurora/READ IF NOT WORK.txt
- Size 105B
- SHA256 913a000455342a62c90bead4ab5b0466477f74a1d48ee0eb3f13e811c4610af6
Score1/10 -
- Target Aurora/Aurora/SiticoneNetCoreUI.dll
- Size 31.9MB
- SHA256 dff567d9c9f6a906fd0c7eab7deaa4b0f3ba1bd168cbcbca640a46d70ba19eeb
Score1/10 -
- Target Aurora/Aurora/System.CodeDom.dll
- Size 179KB
- SHA256 79e53505a9e9ceafcae4149c303cd1e45e65ca831e07b1e76447ee2df579f242
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Aurora/Aurora/System.Composition.AttributedModel.dll
- Size 18KB
- SHA256 e506dff4ea24163c90b6cac81c8f959efc316308da635e62adf17f610f93333c
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Aurora/Aurora/System.Composition.Convention.dll
- Size 51KB
- SHA256 4a66481a3f9e0ab4c5c50123e7e141ab7028013e2f041941e746e546468544e1
Score1/10