aurora | b2cea676e6cc2cf85f8995a13322fb2798f73643a90929aab299d3bbc2a61ae3

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/10/2026, 15:24

Target
jaffacakes118_install_win_truncated.exe
Size 7.9MB
Sample261010-ste9raev6r
SHA256 b2cea676e6cc2cf85f8995a13322fb2798f73643a90929aab299d3bbc2a61ae3
MD5 85ea33f50a69fb95400a85b3a39a18d1
SHA1 255f930273e1466ad0dd8a7c76478158eb51c82f
SHA512 875f6b4afa9aeec61df89ff58b40a12385f731c9eef81f625b1220885b8cea6b5a232a8cb44553ad9df7f373ddeaa782b65fd239921b8924bc7401d57b25f20b
SSDEEP 24576:x8vO5XkepG5ra76nxCU1v7yUjDTitsc3o+aHsn5GNamIvfPOJJDUf7EErGGRVc3S:mO5X9sra+xCSgFdUn9s2Sz1
TLSH
T1BC86BFB979007CE6E66F437BCA96ADD8137139624B97A5CF4064B7C309733E4EE22904
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aurora stealer

Family

Family: Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5224 set thread context of 3432	5224	jaffacakes118_install_win_truncated.exe	89

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 3432	5224	jaffacakes118_install_win_truncated.exe	89
PID 5224 wrote to memory of 3432	5224	jaffacakes118_install_win_truncated.exe	89
PID 5224 wrote to memory of 3432	5224	jaffacakes118_install_win_truncated.exe	89
PID 5224 wrote to memory of 3432	5224	jaffacakes118_install_win_truncated.exe	89
PID 5224 wrote to memory of 3432	5224	jaffacakes118_install_win_truncated.exe	89
PID 5224 wrote to memory of 3432	5224	jaffacakes118_install_win_truncated.exe	89
PID 5224 wrote to memory of 3432	5224	jaffacakes118_install_win_truncated.exe	89
PID 5224 wrote to memory of 3432	5224	jaffacakes118_install_win_truncated.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_install_win_truncated.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_install_win_truncated.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_install_win_truncated.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_install_win_truncated.exe"
  2⤵
  PID:3432

memory/3432-0-0x00000000007F0000-0x0000000000B4C000-memory.dmp

Download

memory/3432-5-0x00000000007F0000-0x0000000000B4C000-memory.dmp

Download