e4217e7ca42ee2fa3ecc5d1a253c6a6c9b8077873c89a8daf182728487c20d7f

Sharing

Copy URL Twitter E-mail

General

Target
Aurora17-Windows-x64.zip
Size 319.6MB
Sample260826-rvdxmseq5s
SHA256 e4217e7ca42ee2fa3ecc5d1a253c6a6c9b8077873c89a8daf182728487c20d7f
MD5 4587e2158e14bf7378b57ef82ebbb83f
SHA1 aecb23697042295ff7b0363d36395f158819fe67
SHA512 6b00ba66846c368479d743691883e2961605f80af2762867ee0f03b1b7b25028ad8d521000bb87474f0f123efe8884fc079bb1c7f47b54c0922257134e5e8de4
SSDEEP 6291456:97VH65+emps0YCpTjBeXVdZqnMxMIfixF5/R1PEpj2pKTp/ARCvK7g7sJclo:lVa+/suTjBeXVOMuMixF9R1P2jsKTFj2
TLSH
T140F833D4B694871F3E10627385616FA1E06DCCAEF6BB14293AEDAB8352364CF7905C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Aurora17-Windows-x64.zip
- Size 319.6MB
- SHA256 e4217e7ca42ee2fa3ecc5d1a253c6a6c9b8077873c89a8daf182728487c20d7f
- MD5 4587e2158e14bf7378b57ef82ebbb83f
- SHA1 aecb23697042295ff7b0363d36395f158819fe67
- SHA512 6b00ba66846c368479d743691883e2961605f80af2762867ee0f03b1b7b25028ad8d521000bb87474f0f123efe8884fc079bb1c7f47b54c0922257134e5e8de4
- SSDEEP 6291456:97VH65+emps0YCpTjBeXVdZqnMxMIfixF5/R1PEpj2pKTp/ARCvK7g7sJclo:lVa+/suTjBeXVOMuMixF9R1P2jsKTFj2
- TLSH
  T140F833D4B694871F3E10627385616FA1E06DCCAEF6BB14293AEDAB8352364CF7905C1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Aurora17/Aurora17Client.exe
- Size 33.5MB
- SHA256 1edf1df535a29b525361217f5744ee472aa93948493fc7822bd695e889c56e9a
- MD5 5b3d9c674eace619160abce005692847
- SHA1 0c3e4d525430831dfa0628cc72de312b189b4efa
- SHA512 39b1d4fe7a6b9bd5675c1887c101c4d40f4ef433c3b053ba974858e711eaddb682462f8805832aa98b07ae915e6bacb5f09b13e9dace197eee383bf4945ac964
- SSDEEP 786432:VuMLutD6tdUh5RpznbQiKecCTCzd/vNeif0pE5:V5cBhdn0iKCTGXA/8
- TLSH
  T107771256E2FD00E8E57AC0B8C6575517E7B1385913309BEB52A48A692F37FE0AE3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Aurora17/Aurora17Connector.exe
- Size 68.8MB
- SHA256 b017753631c5ba96ea6a098fbd325234a0050e43fb040fffd0223294c304c2b4
- MD5 c2cd3f3054b7dce5691eeeb0f8b839e9
- SHA1 d8eff7cf7fcadc17f0a9123ef7775cbb2add7842
- SHA512 81d8b47ab6527b3a21980653cf92db35fa3d19fa55a6130a7ede825897c044650d3ff193c62fdcb506210595803550ad20254b7a306b4f09d96b5c710dae798a
- SSDEEP 1572864:t5bhdn0iKCTGXA/F7crWwOXIU93jHh7tGPkwVoSPxj0C:4FCTGgJwOB3jHhQrR0C
- TLSH
  T154F72356E2FD00E8D57AC0BCC6575617E7B1385917309BEB62A48A652F33BE0AE3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops desktop.ini file(s)
behavioral5 behavioral6
- Target
  Aurora17/aurora17-package.json
- Size 184B
- SHA256 16a0cb48138362ec813d6005883dc13f00d82cb213ced7ab29e4c35bdae5cd42
- MD5 05b560c710403b8fa4534fed5a878d3c
- SHA1 435ccc16161c621c89cf7a6ae47cc7fafab8a67f
- SHA512 36f2e70d9154225976d2a8600789f5a70566af4d990e4a90e882b4346f1e29f8efd20ffb1eb8982a5930ff38b7307e0fb81c9887c1c506979128bec2656a0078
- TLSH
  T19FC08052AD30197712B1579D626540B7B2350F8FA3F00C8F70F71904405B62D4861F95
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Aurora17/scripts/Add-HostsEntries.ps1
- Size 4KB
- SHA256 79ea44b3c656b5af8abd8a90cd9dbe943e9315f69a2c54099d951cbea6dfed9c
- MD5 5d56758dac6e341d165e256999202621
- SHA1 9ca6ddb6916c9e7d1e9575826007d482cc1fda9b
- SHA512 ff1537d4498c3058f985591dc69fd1625935b20c883094ed3175400f4222bff4544d7f5f51746019e9a1a49142ba81c4f5089b3d7bc3ceb55a0d014291582157
- SSDEEP 96:uHWsiBTm/mzl/DZ6vySZEf8h5JupHXOZemTu:ZsiBTnl/Hh8hMHXpmTu
- TLSH
  T1FDA19335ED92856922B2637D9953C35CFF1A127FC9711251B2EC41C8BFF4018A628EF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Drops file in Drivers directory
behavioral10 behavioral9
- Target
  Aurora17/scripts/New-DevCertificate.ps1
- Size 1KB
- SHA256 db6226b46a128f9ed52a0fee9fcaf762b842c1fbac55214e620462cf70f94bde
- MD5 b5869b51924afd50398640e05ddc3e2f
- SHA1 959e0ae57d1a886df857c834ecd0b2bda7d83e8b
- SHA512 1565189f408bea461a0dfb2b71d710d8a3f969f2c6a11461358b89c366c54fa367e31641a598de393aeb0de1df5b156754d96ba366b6cc7c01b2a16769007c73
- TLSH
  T1A741531713025D751AF143A7C196E296EF2B80B7022B2816B5ED048C3F3BC0AC6392E7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral11 behavioral12
- Target
  Aurora17/server/Aurora17Server/Aurora17.Server.exe
- Size 140.6MB
- SHA256 9fb5c38a3c4327554c43e15e437b84eeaa50682841719730f52579084f64e7b2
- MD5 d58504af91f8e0afcd89f9d0aa1b9280
- SHA1 247c68b16734a2ec1a7ac850160684840d96782c
- SHA512 6bb34992676b8cb7f1ebc149a40ba1a9e3a6e5b2c64cb0e49d406402790bcb067aa64c29c43e528ab3811eb68384f763d2ba151b4594f5c1c3df1ebc902101e0
- SSDEEP 3145728:/HN00ScGRU9ScVKg26IxTDUK1iFDnf+aGWGL/ps6A40WgFCTGo5z:/u0SbRhO2hx3eFTfuT/pLA5aGoB
- TLSH
  T1026833C1B7643098D027C0B988AF4607DBF0785657227BDB53284A18BF77FD66EB8660
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Aurora17/server/Aurora17Server/Content/assetdb.bin
- Size 3KB
- SHA256 4832ed4bcd06f9b0779e37b21ea1c95ec1b4f8e89af9f31e1ca8dbbff299b91a
- MD5 817491121e2916bc5b53ce25dc6f23db
- SHA1 fd752edb2e3f207a8e2459244d508b769d693c70
- SHA512 6387cca7f9a3ed2c2b0e7ecacd9bba8192261c3c42042b560024a4a666d87956e7e752619418aab591e71aa5d03e869a885528290d76a33a750c52397253af19
- TLSH
  T133713B24CE0C364DA8AC2F4F1067E624638504AA5D71C3EA96385EBB7EB9094FC553D1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Aurora17/server/Aurora17Server/Content/cardsdll-json-vocabulary.txt
- Size 12KB
- SHA256 f8ce7652ef2443887c0d9abaa13734f6bc153f8de6b02ab8beabbf53cb69ae15
- MD5 c17e4dff3b95d8a572c8f81be3f8dc16
- SHA1 a2b322cabb842afd6944d1220685f61c6c17bea0
- SHA512 997c8b9d812f729683311d96844dff3438ca721004196394966c02922f7f909b88b435995f6fb2b8709dd3d7b8b3c77400f3e05d5a6a96d80a98d2c18c63840e
- SSDEEP 192:9isrywPyE+W1yXuoKiiv3EynwYtijTmYvm92bg4EUk52NIO+L9IvTgZzclav3tDS:Y9bE+1OvUynwYtijTj+92vIrL9IcD9bg
- TLSH
  T16C42F9B29141B5E54DDEB7C8B026A492E27600D31E177048FACA45EE351AD9C3B36E32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Aurora17/server/Aurora17Server/Content/cfgrouting.xml
- Size 6KB
- SHA256 0107098093c8e3c9fbdc340b03d0e6ea5de54d67a243d3e3eb7388a4b11ff489
- MD5 5171d086b22e2622951451c70d5adb0b
- SHA1 e85f66650303446b56f987a1d2f033c9f3b0e606
- SHA512 cbf0a309014e9c679315c1ca34a43ed8b2aa2c480d0316ae8544b4701b292ea3c819350db1a0c17ca9603a68976972fcb0abaa2da1063ecf39ca8e5a23b3754f
- SSDEEP 192:t0m9D9dmurxzs+GZot5G5ZmnvS/2fUDsYXOvlE:meB5z3vG5snvSeMQY+a
- TLSH
  T12AD10A1670AAEE200E7115512EDA586E91649B3B431B30DC73F879BB77C3A7D31993A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  Aurora17/server/Aurora17Server/Content/fut2dheads.big
- Size 79.7MB
- SHA256 964a1c64e454ff5bbcb040a0dd099609b2953e715bcb1e9f452f7ad4fd6a3c97
- MD5 8871db6c39350c63b79768f6be924ed6
- SHA1 b0a1f3e541d148dc28a79ce3b389ee57c5c27dd3
- SHA512 54a0cf73631875a111dff355220eb677c5dd5af094a6076e05cf45560df0aa91d4974df7cda1a418ee2e2b8575a64fa2390f89e5a6f5309dc95b56399842e0ee
- SSDEEP 1572864:9WaNrD80S3sGRb4Y0ScuBs8d6jA3waeJhSQY6IxTDUKNJ68c6zNWbFzvnfPmaGWK:9HN00ScGRU9ScVKg26IxTDUK1iFDnf+l
- TLSH
  T10C0823C03B01B516E503DABA08EF97458BF5AE92EB237F1A87181515FCA4B1B6DD08F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Aurora17/server/Aurora17Server/Content/fut_dynamic_art.pack
- Size 14.6MB
- SHA256 11b31fbe510e47ac2d47a588a3554ddd66b025586208be0f1c5ffffc0a71627b
- MD5 150b9d52ac3c7c057d0451b6e36cd245
- SHA1 5ce5b2f50fd1259d9014101be9757476bdc6c373
- SHA512 2cf858b640ce72622b0ceb94fb1b559fd151746f2dfa49884b492e471a763c7622a395f0e7cbb90082b50eb674bb2cfe736957ab655f0461c538d7a3f0cd332c
- SSDEEP 393216:VfCBbFNYFMeaKuZzXCnkI231VZgz0L4x8:0NVeabZQkIsBPW8
- TLSH
  T1EBF633F3B370AD2CC6A41472555FA4F5FC35120C59A1C79A9B7DF4BC3AA6A048886FC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Aurora17/server/Aurora17Server/Content/fut_players_fifa17.json
- Size 4.6MB
- SHA256 0e8afbc9a87ce83e85c52ff9f91d8d7bd789e036ca6b9e602c3023adc3dfeea5
- MD5 79702bddbe5c1fbd10c924863af18016
- SHA1 de7c625a7088a59eafdf7b872c1db764d5de0d16
- SHA512 6123cd29a2460d3e0bc3a052dd3f251b2cdb8009fb05fbb847e51adbccdf18a8bc50e09c38aa740fedfd58acd50b4550183f76d835383fd18b8d3d5b8d1e7fb4
- SSDEEP 24576:czLun12TLgcxpQ3Jzg6hEhSe8ZdrfplQPUciTcm:cS65Gckcm
- TLSH
  T173265AF2D45CD21BA007B6BE54B85E436378520A6368C03F1CD9BDA861E7F35029AFD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Aurora17/server/Aurora17Server/Content/fut_quicksell_values.csv
- Size 1KB
- SHA256 dfbe82b3e5f1733cd0392a5334059b5d0f7c009b8f25df51f4e4859301ffe714
- MD5 73fbb799359f3b357dcd3c3e0eac8c9d
- SHA1 304557bcf1401a1275dbd41611e9bc00081462a4
- SHA512 3822825888df1ef920e41c94e4b1ed54a007f51505e716428014db0ab65525e4db2e38e157046d34b82478c24633cd041793ce5373d8b0c275c6ab4394107916
- TLSH
  T1B4314371039941C6F9A240C991F83E1652BAF9953AA8F42797DB12AF8C0ADB1C104BF9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Aurora17/server/Aurora17Server/Content/sbc_tile.png
- Size 43KB
- SHA256 98041a29477f571fd9a7db4759ebe35a5b78004dd6e0bf1abcd761c0d22cd148
- MD5 fb711329ebd8466eb5e2ce6c0d661e79
- SHA1 de07d83fe37c84b4df0680c8ae6becbd1c3f0ba3
- SHA512 c42a21d20443a0110c8b8198dba6d830498f595701c2f4d24d500643aa1b9d5a0793bccb2f4f9cadeddd0666cfc4baedd3f764d2f9f2beb333554ff37f6f385d
- SSDEEP 768:b2pNmNiiXYbz+27ovupQR5K7PIu4k5QEE8Wr5CGeayXkJ28vorpzJ2ScZ+1r:bbXUXzpumPF4wE8Wr51XyXkJ2hp92/yr
- TLSH
  T11413F1F72D1978B16DCF187BE24382CE2B615216CC63217CEC97F25A597AB0C6707819
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Aurora17/server/Aurora17Server/Content/storepackdescriptions.xml
- Size 162KB
- SHA256 f0fafe3f87025b41baf9cdda660807df356618a5e672fb6c2d58cf08034609ca
- MD5 d0912e640f4d328335294ac111fb8aaa
- SHA1 52100a057f535c5847123992298d16a6fd7b6274
- SHA512 bf7582434a3720c373123e67e01cc01bda5711d70c09a7e1479884fb0213bada5e3574503050b6d12279e62d824eaefa4a8409cbf634b37d4b802badad5ab93d
- SSDEEP 3072:GgQJphPFkqXFwJZ9zNhGcfTompVCIbWojxO:LJZ9gojs
- TLSH
  T137F30A1EDDC14577276AC3211A880243A9CEC1B7B35A60D8FBCC7A0F5BB980AC69FD55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops desktop.ini file(s)

Drops file in Drivers directory

Badlisted process makes network request

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32