aurora | cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707

Resubmissions

20-02-2023 05:27

max time kernel
291s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 06:29

Target

Installer.exe
Size

7.5MB
MD5

b2c713fe8dbaea840c00afd0f67f1d9d
SHA1

036dab17619a4ca6e1036d99b68b10aea5872968
SHA256

cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707
SHA512

03276046a65a6fda948f63d3e5bb7d4466ff2933677c0f847f927d50b04f3d1600d3c7e5fc905f6a54f2de9fdedc46326d39c160ff37d3a4cd874d20f01cef18
SSDEEP

24576:24wquL3a5sUcuADwRSP5C5AG1yO80IpNKF7r1IlP6jBktGr4ICqJIJFTWjiQWdtC:CquL38soADw45Ccgk+lKCtoPEz1b

Score

10^/10

Family

aurora

94.142.138.29:8081

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora
Suspicious use of SetThreadContext 1 IoCs

Processes:

Installer.exe

description pid process target process

PID 4600 set thread context of 3840 4600 Installer.exe Installer.exe

description	pid	process	target process
PID 4600 set thread context of 3840	4600	Installer.exe	Installer.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Installer.exe

description	pid	process	target process
PID 4600 wrote to memory of 3840	4600	Installer.exe	Installer.exe
PID 4600 wrote to memory of 3840	4600	Installer.exe	Installer.exe
PID 4600 wrote to memory of 3840	4600	Installer.exe	Installer.exe
PID 4600 wrote to memory of 3840	4600	Installer.exe	Installer.exe
PID 4600 wrote to memory of 3840	4600	Installer.exe	Installer.exe
PID 4600 wrote to memory of 3840	4600	Installer.exe	Installer.exe
PID 4600 wrote to memory of 3840	4600	Installer.exe	Installer.exe
PID 4600 wrote to memory of 3840	4600	Installer.exe	Installer.exe
PID 4600 wrote to memory of 3840	4600	Installer.exe	Installer.exe
PID 4600 wrote to memory of 3840	4600	Installer.exe	Installer.exe

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
2⤵
PID:3840

memory/3840-13-0x0000000000530000-0x000000000088C000-memory.dmp

Filesize
3.4MB

Download
memory/3840-12-0x0000000000530000-0x000000000088C000-memory.dmp

Filesize
3.4MB

Download
memory/3840-15-0x0000000000530000-0x000000000088C000-memory.dmp

Filesize
3.4MB

Download
memory/3840-14-0x0000000000530000-0x000000000088C000-memory.dmp

Filesize
3.4MB

Download
memory/3840-11-0x0000000000530000-0x000000000088C000-memory.dmp

Filesize
3.4MB

Download
memory/3840-10-0x0000000000530000-0x000000000088C000-memory.dmp

Filesize
3.4MB

Download
memory/3840-5-0x0000000000530000-0x000000000088C000-memory.dmp

Filesize
3.4MB

Download
memory/3840-0-0x0000000000530000-0x000000000088C000-memory.dmp

Filesize
3.4MB

Download
memory/3840-16-0x0000000000530000-0x000000000088C000-memory.dmp

Filesize
3.4MB

Download
memory/3840-21-0x0000000000530000-0x000000000088C000-memory.dmp

Filesize
3.4MB

Download