7d985233323111ecbde1549ce6137cda1d129ed7fd0aef926b6c579112c0c566

General

Target
aura.lol cracked.rar
Size 550KB
Sample260827-me35dashkc
SHA256 7d985233323111ecbde1549ce6137cda1d129ed7fd0aef926b6c579112c0c566
MD5 2e33299a64fa65ea648f53a81cc76b96
SHA1 d49c4855da44758d31c9a352616168eaed5fd7fb
SHA512 f9e36505121721d3ccd7edc299148f602690eb180c70f8c09a355109d7fb06cd25b6810a0fbcd866a526988adf808e5dd956add3dc4bbc5679200094add05d21
SSDEEP 12288:niMpJrWzrdg0zPmZGsvegoOYIuGWhtopEyPI3KoJwzGR7glGEF:niMpJercvNoOYIP6ep3zoJ1glGa
TLSH
T14AC423DB68BA7348A5DBD27BBB424BE6910A87D7F568D03B075CCB6600067C6FB1814C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Targets

- Target
  aura.lol cracked.rar
- Size 550KB
- SHA256 7d985233323111ecbde1549ce6137cda1d129ed7fd0aef926b6c579112c0c566
- MD5 2e33299a64fa65ea648f53a81cc76b96
- SHA1 d49c4855da44758d31c9a352616168eaed5fd7fb
- SHA512 f9e36505121721d3ccd7edc299148f602690eb180c70f8c09a355109d7fb06cd25b6810a0fbcd866a526988adf808e5dd956add3dc4bbc5679200094add05d21
- SSDEEP 12288:niMpJrWzrdg0zPmZGsvegoOYIuGWhtopEyPI3KoJwzGR7glGEF:niMpJercvNoOYIP6ep3zoJ1glGa
- TLSH
  T14AC423DB68BA7348A5DBD27BBB424BE6910A87D7F568D03B075CCB6600067C6FB1814C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  aura.lol cracked/BeDaisy.sys
- Size 19KB
- SHA256 66604c370dd1a6ca8e5cc641024df8b3711171803677d210192d20c7aef4399d
- MD5 8572f5c0ab214077e2de6b2bd0dcc8a8
- SHA1 8963e25a5b31f107d491fdfde0285739552e9016
- SHA512 660e838eabb48baeefc0e9df9086882e28da43268c9471e628789c4cb6a47bac01badfae94797acedbc6bafa700373cb7ecee2a65c938c1ca86c94866060c63f
- SSDEEP 384:euregI48Iq1qhvYoP6MUMv5g5M/b0475aAJo/W:eSUi/UMvTJaAe/W
- TLSH
  T10D923DC3A39C58D5F31DC17B86661A27D2B1BC24275377DF0252C02A1797BE8763AB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  aura.lol cracked/Mapper.exe
- Size 150KB
- SHA256 c2cab125d36caba39e6ff0ae83c68397e22317eff2944a6ed69d2236024a76c4
- MD5 4c4e7925a787c82a817b040f009b6a61
- SHA1 4f6e989829b07f2d3077bcb0ea6f8f09b8ac1b16
- SHA512 c4f15fa3ed4510b5950f366c17e17ceacc4c7220c48f4e838dd07897ab566e624856bc893d53f65bac1d2f1f66759a89831555007816e70b24e80e2c08d74d0c
- SSDEEP 3072:QQeuLZ8OB7/Us7sMDcFS0DzbskwBmJTQSaMm5/6YJvg8V:QgNpBDUs7ncFSQ31JWlj2M
- TLSH
  T1FAE32A1797A9106EF1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F227D0BA3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  aura.lol cracked/aura.loader.exe
- Size 13KB
- SHA256 74c2c3a204c9bdf82d08dcc123013290e545892bf94a906cd149a2e6098992cf
- MD5 a4a9900b5def1d50ddc3019499bf0576
- SHA1 25c0ae34d4faddfe1630fff834584d45e380ddff
- SHA512 5e86fda325c619a29c49f07efb47f2dffc3a0a83054baa4e8e227ba9034c8fd09ed3b876528bb21e3b63ddb38013e48ba63c1f5a292e0b4538c0868865a83186
- SSDEEP 96:DaOld4pS2w1lWZPLwu31HYv4Y709hgSkngljd1Z6mht5bOVLNoLJmLJILENKzgHN:nbKUKPLHlHQ4YI9hJrjwTNYgHVs+
- TLSH
  T1CC52BD1932EB4600F17A973F89B3F105D73F75A289368E4A42BD01861BEF6415EE2F52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  aura.lol cracked/aura.lol cracked by dwmxs.exe
- Size 1.6MB
- SHA256 071ec0ddd6ccaf4063c61101925a81dcd881f1816268c90c9aff8aec7189c0b9
- MD5 5a6ce7457ebe53e088252c0c310c9219
- SHA1 d4ff52dd770c2abd9ac745d27c7f8b1c2f2b0bdc
- SHA512 16da79182801031a99ca628668a41fe7f143a3c5de813df6192215fa711f15221fcf6b5e819faef9ff0636c98635890f71a8a4408221253c26b2096abadf0255
- SSDEEP 12288:DVLS2qw3FtTeo9ZnWc/KQqEccoKWFe5zndZFvPvPh0YuujmNZht:RGw3F5eojnWc//ccoKWFe5zndvPXIt
- TLSH
  T1BB751846E6A649E1C476D134A0E2F23BFA753C78813593136BD97E332BF1F60A95A340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5