General
- Target FPS MAKER ROMU X ERNS.exe
- Size 81.8MB
- Sample261110-xq8jcaab29
- SHA256 e2d7309fed0b0d3b6953177cb221fe5ea2a73818155a604679655536f94ed21a
- MD5 f5de49e47f1b7e169123b75e502fe952
- SHA1 53600d4447f255c6568295c7d3e5182f12fbc93c
- SHA512 a4f6b08920f3566f88b0b018c8c6ea64b6fa20f4f921f353c8133a3b7ed12d964b0b8afc6b5cbca083d55584884699079a79e784d03162224ba0b1e8982047af
- SSDEEP 1572864:tXJVrvo2pUg9NoX0R+dgu5ib1EM4q/sLU5x6sowCGRnisqCyBPhZSI:pv7ig9NXXZEdg5xEwCGRniagT
- TLSH T14E1833352A94D9C9C5520E3D56E97B18207DDEA13B2741B7E9B201A33E3BFC76E6018C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
FPS MAKER ROMU X ERNS.exe
Resource
win10v2004-20260911-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
FPS MAKER ROMU X ERNS.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
main_Aura_Erns_v2.js
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
main_Aura_Erns_v2.js
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
Malware Config
Targets
-
- Target FPS MAKER ROMU X ERNS.exe
- Size 81.8MB
- SHA256 e2d7309fed0b0d3b6953177cb221fe5ea2a73818155a604679655536f94ed21a
- MD5 f5de49e47f1b7e169123b75e502fe952
- SHA1 53600d4447f255c6568295c7d3e5182f12fbc93c
- SHA512 a4f6b08920f3566f88b0b018c8c6ea64b6fa20f4f921f353c8133a3b7ed12d964b0b8afc6b5cbca083d55584884699079a79e784d03162224ba0b1e8982047af
- SSDEEP 1572864:tXJVrvo2pUg9NoX0R+dgu5ib1EM4q/sLU5x6sowCGRnisqCyBPhZSI:pv7ig9NXXZEdg5xEwCGRniagT
- TLSH T14E1833352A94D9C9C5520E3D56E97B18207DDEA13B2741B7E9B201A33E3BFC76E6018C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Loads dropped DLL
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
- Target main_Aura_Erns_v2.pyc
- Size 125KB
- SHA256 19ba2ac0c074d22a35c16f5775bbdd82796d21743ba3ce0b25994e9603a4d0e1
- MD5 eeced230db8417e1bfa82a56e3c87d7c
- SHA1 c9de368d6897232e38c5b4d75fabbacfa47c46e9
- SHA512 a728ba15c94f6e7427e6c84c08ea374d9e65d9b06002092980e061284964ccea07e0dcab28ecbd47cbd763b7cdb23bd137b0522e81b270af2ef167bc2df77c88
- SSDEEP 3072:kHZsQXtv+oqa+zn3ndxanfcoir88/qlm0:0Zptv+62NxAcpid
- TLSH T125C3E838A438B527E8EDF67E30E6D445A72281867601DF17F23A04FE7EA4669CD5120F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10