79519a03775663610c38aa0e3ff42127a7d6fea5615105d4e2599a0f9ffa29d7

Sharing

Copy URL Twitter E-mail

General

Target
Aurora17-Windows-x64.zip
Size 320.3MB
Sample260831-tedm2sx1bs
SHA256 79519a03775663610c38aa0e3ff42127a7d6fea5615105d4e2599a0f9ffa29d7
MD5 77508aff25f544f554b689eb38bc9df0
SHA1 0858bd21ff1f3957c87a406b6b54dcbfde36fd1b
SHA512 aff09d9ccaea8c94965c683433ee1b320f111a8211ec30a47ff5758cef94d05a9b277f81c2f2178801518d9f29c661395067b661c68918f4b466ba8091879203
SSDEEP 6291456:kmVux2JW2ZIMXGEeT/NcD0uAxHXs8uJbUkNfQknM2pKU/p/ARCvK7g7sJclF:VVuxf2faT/NJxHc8YVQknMsKGFjvK7oF
TLSH
T14EF833D07B0C8B8E2D7075B789F27FF1D4ED89ADB2BA5612758DAF81827168BB50041C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Aurora17/Aurora17Client.exe
- Size 33.5MB
- SHA256 f81e4a41e3a22c0de2783f3945df40003b35d4b72c6a918f32b096a293ced262
- MD5 b4857b4f3f9a80164a3a74bd9182ec94
- SHA1 ea1b7f1f789a633f83121d1571b459ca16b65f85
- SHA512 faf50f415044fbc45af166f00c2462ceb409ea881f2de243364539901bf9d154e6c1ff8d1bea92c5180d28215840bc8b23a6533a22a9667906fd10f56844b949
- SSDEEP 786432:tuMLD3O6tdUh5RpznbQiKecCTCzd/vNeif0pEc:t5Yhdn0iKCTGXA/J
- TLSH
  T122771256E2FD00E8E57AC0B8C6575517E7B1385913309BEB52A48A692F37FE0AE3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Aurora17/Aurora17Connector.exe
- Size 68.9MB
- SHA256 e73c0d6a7e8b7f21a829b79446b667b4d6faeeedda470038653aee72d5d7579c
- MD5 cb38c41d20810d3a25c59ddf0a1bf772
- SHA1 79b79dc69ed9fd0efd35bcc1409e8aadf4edcc2f
- SHA512 22b16a41ff31a4a63c285f040c1f4d8085c50fe11a443b7cd854593f6cbdf9c522f47f00319b990912ce1dfd439b2eefbf5ff8d86cac57720aed9cafbe71bc37
- SSDEEP 1572864:t5chdn0iKCTGXA/F7crWwOXIU93jHh7tGPkwVoSPxj0L:3FCTGgJwOB3jHhQrR0L
- TLSH
  T13EF72356E2FD00E8D57AC0BCC6575517E7B1385917309BEB62A48A692F33BE0AE3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops desktop.ini file(s)
behavioral3 behavioral4
- Target
  Aurora17/scripts/New-DevCertificate.ps1
- Size 3KB
- SHA256 69f670e33dc06cd98b82517b5fa51f4b415416d3d380cce29daa368e769357b9
- MD5 0fcc612114ab28865e36fba2de18bf98
- SHA1 2a3c3098f29c43fea2c46e9a894c5b623ce001ba
- SHA512 16ed7827ffed1f95ba35f047540d0ab81c30351b781a54134201c577d819e1dd3349774cca2f35100b24e93ca691ac4ec927a522705f197e99b3120a51a1d8f0
- TLSH
  T1B561821622029D362EB25BB7848765A4EF4E00BB021B261175DE848C3F37D2DC72D6DA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Aurora17/scripts/Play.ps1
- Size 24KB
- SHA256 5d5d248cc156164f52e6908de506e3d66bd39338b364e3149ba33b61a11a37d7
- MD5 ded63f3d906dd3d21edee609e3b4e785
- SHA1 07c155b792be67b16cd44229c284a466ef8e1ea1
- SHA512 58f144777b8431b09b029ea6410c11b220138afb385d314d4ebb030f1fdfd8c8c03030d9f55d00a1934acb5f2e4c7b39376dd14ef738e80c0823fd6fa9f139e8
- SSDEEP 384:KDOtI83o5fmKHclCn4a+oq7+PFeCuMweHyB7jV5:KSIHm10BeCuSyB7
- TLSH
  T1FBB2A4193109813A56FB477EB9564012EF6A007B033B1224BAFDD1867FB456D83E9FCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Aurora17/scripts/Refresh-PlayerHeadCache.ps1
- Size 2KB
- SHA256 c5acdfe991942383a8291b0cea24a9b3e1e488c9a8e7d3f28c7ce756790e9c65
- MD5 bf85cc8f911785c45f9a617f5410fecc
- SHA1 224c9de2a187b41bd3d3a858b996d3858eedb531
- SHA512 80ca706558f06f75c6f03cbac883d207c57fb8d4c8826476da46e4ad4a055ddeb2381ccc134882f14bbcd503d7f12babe79343eec4f25a350c00f0a2df51fa05
- TLSH
  T1E4510EE12A07103449625BFE1246A2B0F537001B46664330F8EC5A0EFF7892D1BFEDDA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Aurora17/scripts/Reload-Content.ps1
- Size 874B
- SHA256 d3e6e72d6d82dd66443a766bc3aeb6070efee08d0a20e2e92b380c90201d8c0d
- MD5 e29fcf4bd96acd1af1c3e5f49d7db8e1
- SHA1 6f39c338119168ee7ef42f116e945c63904c3731
- SHA512 f2d7f10f5449825a65c5f6695e6fa3d174aee908bf0b22c1f0e093c0817f1e008fecd5f5f1d49c61bb9cf577a14a1a4b838fa05d7456c9547e02c577c9bef39b
- TLSH
  T12D110C963926033213F3C14E378B6A42E110F091563808FB7ADC6C4C13F41E8A72F9AA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Aurora17/scripts/Reset-FutClub.ps1
- Size 2KB
- SHA256 63b9e6ff01406074fd1e578bdfb9ec774a1eb0fd6f65b46c20f1ff49033ea209
- MD5 e47594c477dd54472921a07bab3c03d9
- SHA1 5083ca05aaf603929bd21098c866671e9d60d364
- SHA512 4cb902264c6ca075cfc2d9e0449f8db064fd80fd5909c1af644433c7d8ea1adcfb352cf066428b59971b6c5ab682fe3731cc9d709ed1966be60a97de5fb095e2
- TLSH
  T1C4519753BD12433B13774FEF3B855E14FA25302241561AA7BADC64193BDD02CB62FA48
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral13 behavioral14
- Target
  Aurora17/scripts/Test-Connection-Path.ps1
- Size 3KB
- SHA256 b8c1cc97f15e23664705c744a30ea70ed67cd83966be985b955e46240cece239
- MD5 71d9908810f2d6d21f8aa0cc9ec0f781
- SHA1 7c2cbcf56352e2a6d801bf2992367023b8dd0718
- SHA512 bdbdd22e464a4f543f77b7c961a3c1fdfd12d5f8a7c52a3a7a0dbfcf823b4d86830b175e1e033fe3187d62ac025490704b14d312ae88bbecfd311462661b4060
- TLSH
  T1EC7198163702323E0BB3276B890BA958FF6340B7536524A1B24C91887FB575CD034EFA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Aurora17/server/Aurora17Server/Aurora17.Server.exe
- Size 140.9MB
- SHA256 a4a3dbaaa3506235375205ec90d8f9b73de09f98d53e2bde3817c4f1cc9548f0
- MD5 9d7f4892397596d2eb3b98dc34fe3a52
- SHA1 a332bdc2a97a21297c0d9dc744f3f4840042ce9a
- SHA512 3ea1cc4f44de09fc20308d6560bd4fce9788298e6b16e36f1c4e45e79fcc5e09c5162c35eca38dfe3e7260ba79b463bb7160a521f26e6780f13d62b7e2470bb9
- SSDEEP 3145728:QHN00ScGRU9ScVKg26IxTDUK1iFDnf+aGWGL/ps6A40WeFCTGo50:Qu0SbRhO2hx3eFTfuT/pLA1aGoS
- TLSH
  T1506833C1B7643098D027C0B988AF4607DBF0785657227BDB53284A18BF77FD66EB8660
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops desktop.ini file(s)

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18